Splunk Enterprise Security

Saving and Retrieving SPL Searches on Demand without Scheduling

AL3Z
Builder

Hi,

I would like to learn how to save an SPL search and be able to retrieve it whenever necessary. I'm unsure about the process of saving an SPL search without setting a schedule for it to run, and I'm seeking guidance on how to achieve this.

 Thanks

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Save as a report - you don't need to include a schedule - you can find the reports under Settings -> Searches, reports and alerts. From there you can Run the report when you want to.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Save as a report - you don't need to include a schedule - you can find the reports under Settings -> Searches, reports and alerts. From there you can Run the report when you want to.

Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...