Splunk Search

How can I extract the exact search string for modified saved searches from events in the _internal index?

New Member

Hi All,

I want to list all the saved searches which are modified (action=edit) from the logs, but the exact search string is not visible in the logs. Can some one guide me on how to approach this one?

0 Karma


I believe the search string is not logged on edit, consider using version control.

0 Karma



It might not fully answer your question but I think it's a good start if you take a look at my answers here:


It was a very long discussion on how to list saved searches and who has been and hasn't been using them in the last two months.
It contains the search string you are looking for.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...