Reporting

Sideview Saved Search

ccsfdave
Builder

You may remember this from a few weeks ago, I a pulling in RSS and taking the link and making it the link to the title of the RSS article:

<module name="Search" layoutPanel="panel_row4_col1" autoRun="True" group="Symantec RSS">
    <param name="search">source="rss" link="*symantec*" |dedup link |table title link|head 10</param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">link</param>
        <module name="Redirector">
          <param name="url">$row.fields.link$</param>
        < /module>
      < /module>
    < /module>
  < /module>

I would like to turn it into a saved search with the same sideview functionality. Is it as simple as changing to a SavedSearch module name and the title of the search for a param?

Thanks!

Tags (2)
0 Karma
1 Solution

ccsfdave
Builder

Well, I should have tinkered before asking. This works like a charm:

      <module name="HiddenSavedSearch" layoutPanel="panel_row4_col1" autoRun="True" group="Symantec RSS">
    <param name="savedSearch">Symantec RSS</param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">link</param>
        <module name="Redirector">
          <param name="url">$row.fields.link$</param>
        < /module>
      < /module>
    < /module>
  < /module>

View solution in original post

0 Karma

ccsfdave
Builder

Well, I should have tinkered before asking. This works like a charm:

      <module name="HiddenSavedSearch" layoutPanel="panel_row4_col1" autoRun="True" group="Symantec RSS">
    <param name="savedSearch">Symantec RSS</param>
    <module name="Pager">
      <module name="Table">
        <param name="hiddenFields">link</param>
        <module name="Redirector">
          <param name="url">$row.fields.link$</param>
        < /module>
      < /module>
    < /module>
  < /module>
0 Karma

ccsfdave
Builder

You have screencasts? Do share!!!

0 Karma

sideview
SplunkTrust
SplunkTrust

Yep - you can mix and match to the extent you want. I wouldn't use modules like ExtendedFieldSearch or SearchSelectLister, where the Sideview module is a vast improvement of course. I need to record another screencast to clarify which core modules are still useful - TimeRangePicker, SearchBar, JobProgressIndicator, JSChart and a couple more. But there's really nothing wrong with HiddenSavedSearch if you're not using Sideview-style report-saving.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Make Your Machine Data AI-Ready in Splunk

Every team is getting ready for AI agents.   Thursday, November 12, 2026  |  11AM  PST / 2PM EST   ...

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...

How to Monitor AI Agents with Splunk Agent Observability

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...