Manual additions to savedsearches.conf overwritten by web GUI

[noahzstahl]

Hello everyone.

The scenario:

1. I create a saved search using Splunk web
2. I want to use the search to populate a lookup table, so I add the relevant lines directly to the entry in savedsearches.conf (action.populate_lookup), and save. (These configurations can't be added through Manager, as far as I know)
3. Later, I want to make a change to the saved search, and do so through the Manager within web GUI. I click Save.
4. I notice that the lookup population configuration lines in savedsearches.conf have been deleted, apparently due to the entire stanza being overwritten by Splunk web.

The question:

Is there any way to avoid this scenario, i.e. have Splunk web be non-destructive to the saved search stanzas? Or could this be considered a bug?

Thanks,

Noah

[hazekamp · Accepted solution]

noahzstahl,

I would think this is a bug. We should not be overwriting the entire stanza. As a workaround you can use the inputlookup and outputlookup search commands to generate the lookup file instead of savedsearches.conf settings. This allows you to achieve everything via search syntax.

Example of a descructive output each time:

search = index=_internal | stats count by host, sourcetype | outputlookup my_lookup_table

To do a non-descructive lookup (useful when tracking stuff):

search = index=_internal | stats count by host, sourcetype | inputlookup append=T my_lookup_table | stats sum(count) as count by host, sourcetype | outputlookup my_lookup_table

-David

[noahzstahl]

Thanks David. I like the idea of including everything in the search string.