Reporting

View saved search SPL without running the search

Tedesco1
Path Finder

Hi all,

I have a few saved searches running on a schedule that I'm using to populate a summary index. My problem is that, in order to edit or view the SPL, I have to click "open in search"... which automatically executes the search at that time.

Then when I want to save them I have to run them again, otherwise the "save" button is disabled.

These searches contain the collect command, so I generally don't want to run them except for when I've scheduled them to run. Is there any way (other than the command line) to edit these saved searches in a way that doesn't force me to actually run the search?

Tags (1)
0 Karma
1 Solution

vikramyadav
Contributor

Yes, it is possible to view or edit your SPL query without running it.
Steps
1. Login into your server (Normally localhost:8000)
2. Go in "Setting".
3. And click on "Searches, reports, and alerts"
And Choose your SPL query name which you want to edit or view.

View solution in original post

vikramyadav
Contributor

Yes, it is possible to view or edit your SPL query without running it.
Steps
1. Login into your server (Normally localhost:8000)
2. Go in "Setting".
3. And click on "Searches, reports, and alerts"
And Choose your SPL query name which you want to edit or view.

Tedesco1
Path Finder

Thank you very much! I had no idea that was there.

0 Karma

vikramyadav
Contributor

No Problem, I am happy that you got your answer.

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...