- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Rename and grouping saved searches.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Rename and grouping saved searches.
These are more feature requests than questions.
Why is it not possible to rename a saved search?
I have too clone it to change the name.
I'm stuck having to name my searches according to relevance.
Would be neat to have a folder like structure.
Are there any plugins(addons) to group and rename saved searches in the "Searches and reports" section?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This gets a little unwieldy I think when we start to introduce multiple search heads, and when the person wanting to rename the search is not the same person who has administrative, command-line access to the search head servers.
If there is a place to upvote feature requests, like the ability to rename saved searches, just let me know.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there any update on this being added as an Enhancement or is there an easier way to rename searches than this? I have admin access to Splunk but not access to our Splunk server so editing a .conf file is totally out for me.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk suggest using Clone, but if the saved search is an alert with actions, Clone doesn't copy the actions.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Welcome.
Firstly it is possible to directly edit the names of scheduled searches, have a look here at the config. If you edit the config directly it will require a restart though so you may find it doesn't have a huge amount of time.
I believe the feature to change the name of saved searches is already an ER (enhancement request) but it might be worth submitting it anyway just incase ->http://www.splunk.com/index.php/submit_issue
As for plugins etc to group saved searches, why not build an App?
If you haven't really looked at Apps before they are briefly best referred to as work spaces. An App can be nothing more than a collection of custom dashboards, although you find alot of Apps for specific purposes its simply because people have taken the time to extend functionality.
You could create an App for each "group", that way you keep similar savedsearches and related dashboards together. Click here for more info about Apps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Restarting splunk is not required.
It is enough to refresh the config.
To reload your endpoints type the following into your browser:
Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!
Transform your security operations with Splunk Enterprise Security
Splunk Admins and App Developers | Earn a $35 gift card!
