Can asterisks (*) be used in search names within the savedsearches.conf?

[Sharzi]

Hi,

I have multiple searches that follow a naming convention like "Server1_Monitoring", "Server2_Monitoring", and so on. I used an asterisk in the search name stanza to match all of them in the savedsearches.conf file, like:

[Server*_Monitoring]

dispatch.ttl=3p

I restarted the search head after the change, but it didn't work. Is there any way to avoid listing all the searches explicitly in savedsearches.conf?

Thank you!

[richgalloway · Accepted solution]

The savedsearches.conf file defines your searches so for Splunk to know what each search is called, it must be explicitly named in the stanza.  Wildcards won't work because the "*" represents a near-infinite set of search names.

[FritzWittwer]

as you have to be explicit whit stanza names, you could put all this saved searches into a dedicated app, and the set the ttl in the default stanza [default]  for all searches in this app.

[Sharzi]

Thank you @richgalloway for your reply!

Since all of the monitoring searches are under my username, would you know a solution to set dispatch.ttl based on the username, not the search names? so all searches under my username would have dispatch.ttl=3p .

[richgalloway]

Write a script that uses the REST API to pull a list of saved searches, filters on your name, then updates them with the new TTL.  See https://docs.splunk.com/Documentation/Splunk/9.2.0/RESTREF/RESTsearch#saved.2Fsearches