Reporting

What is the difference between an inline and saved search? Why can't an inline search be accelerated?

Madhan45
Path Finder

What is the difference between inline and saved search? Why can't I accelerate the inline search?

0 Karma

stephanefotso
Motivator

Hello. I will use a dashboard to let you understand the difference between an inline search and a seaved search.
As you can see bellow, in my first dashboard, you can see my search query: That is an inline panel. My search query can be used only in that panel. It can't be used in another panel.
In the second and the third panels,: References panels, i'm using a saved search, named mysavedsearch, to populate my dashboard . As you can see i'm using the same saved search for the both dashboards, i can share my saved search, accelerate it,... because it is a knowledge object

Conclusion: Inline displays content of a search string or post-process.
Reference display content of a report.

<panel >
<single>
<search>
<query>
index=_internal | timechart span=1week count by sourcetype
</query>
   ...
</search>
</single>
</panel>

<panel >
<single>
<search ref= "mysavedsearch">
...
</search>
<single>
</panel>

<panel >
<table>
<search ref= "mysavedsearch"></search>
    ...
</table>
</panel>

stephanefotso
Motivator

Please, when you want to comment an answer, just click on Add comment bellow the answer, and add your comment.

ok, As i was saying, you can't accelerate an inline search because it is not a knowledge object. You don't have your inline search saved somewhere in splunk. A saved search is a knowledge object,. You use your inline search only in your dashboard, nevertheless you can access your saved search in the application on which belong your saved search before accelerate it.

If you stil have an issue, let me know.

Thanks

Also do not forget to accept the answer, if you are satisfy

0 Karma

Madhan45
Path Finder

great.. why cant we acclerate inline search? and why dont we have an optio to acclerate it?
can u give me explanation?

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...