Reporting

clone saved search, 400 times

joshrabinowitz
Path Finder

i have a nice long saved search:

savedsearch A

index="disk" fs="/path/of/filesystem"|stats ..........

i want 400 or so of the same search, but with a different fs= (and different savedsearch name obviously), but cloning and modifying 400+ times seems wasteful

is there a way to do this using copy/pasta in savedsearches.conf/viewstates.conf?
would i need to manually create vsid values?

Tags (2)
0 Karma
1 Solution

RicoSuave
Builder

Why not create a form search with a drop down that populates all of the FS values? then it's just a matter of choosing whatever FS you want to report on.

View solution in original post

RicoSuave
Builder

Why not create a form search with a drop down that populates all of the FS values? then it's just a matter of choosing whatever FS you want to report on.

RicoSuave
Builder

No problem 😉 I believe there is an example of setting up that form search in the Advanced UI examples app.

0 Karma

joshrabinowitz
Path Finder

thanks for reminding me to rtfm 🙂

Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...