Reporting

clone saved search, 400 times

joshrabinowitz
Path Finder

i have a nice long saved search:

savedsearch A

index="disk" fs="/path/of/filesystem"|stats ..........

i want 400 or so of the same search, but with a different fs= (and different savedsearch name obviously), but cloning and modifying 400+ times seems wasteful

is there a way to do this using copy/pasta in savedsearches.conf/viewstates.conf?
would i need to manually create vsid values?

Tags (2)
0 Karma
1 Solution

RicoSuave
Builder

Why not create a form search with a drop down that populates all of the FS values? then it's just a matter of choosing whatever FS you want to report on.

View solution in original post

RicoSuave
Builder

Why not create a form search with a drop down that populates all of the FS values? then it's just a matter of choosing whatever FS you want to report on.

RicoSuave
Builder

No problem 😉 I believe there is an example of setting up that form search in the Advanced UI examples app.

0 Karma

joshrabinowitz
Path Finder

thanks for reminding me to rtfm 🙂

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...