Reporting
Highlighted

clone saved search, 400 times

Path Finder

i have a nice long saved search:

savedsearch A

index="disk" fs="/path/of/filesystem"|stats ..........

i want 400 or so of the same search, but with a different fs= (and different savedsearch name obviously), but cloning and modifying 400+ times seems wasteful

is there a way to do this using copy/pasta in savedsearches.conf/viewstates.conf?
would i need to manually create vsid values?

Tags (2)
0 Karma
Highlighted

Re: clone saved search, 400 times

Builder

Why not create a form search with a drop down that populates all of the FS values? then it's just a matter of choosing whatever FS you want to report on.

View solution in original post

Highlighted

Re: clone saved search, 400 times

Path Finder

thanks for reminding me to rtfm 🙂

Highlighted

Re: clone saved search, 400 times

Builder

No problem 😉 I believe there is an example of setting up that form search in the Advanced UI examples app.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.