Splunk Search
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: What is an inline Search, How to create one, I...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gagandeep_arora
Path Finder
07-03-2017
10:55 AM
What is an inline Search, How to create one, Impact of using it, Any Splunk documentation for inline search.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
woodcock
Esteemed Legend
07-03-2017
11:02 AM
The term inline search only has context with dashboard XML code. It means that instead of referencing a saved search with search ref you imbed the SPL search string directly inside of the XML. The best documentation on this is here:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gagandeep_arora
Path Finder
07-03-2017
11:31 AM
Thanks Woodcock, I got much clarity from the article.
The search query you shared in the other post is listing all the inline searches executed within a SH Cluster :
https://answers.splunk.com/answers/551415/identify-which-dashboards-are-using-inline-searche.html
It is giving me 2300 search results for inline searches, its just excluding 6 searches may be those were referred as saved searches.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
woodcock
Esteemed Legend
07-03-2017
11:02 AM
The term inline search only has context with dashboard XML code. It means that instead of referencing a saved search with search ref you imbed the SPL search string directly inside of the XML. The best documentation on this is here:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gagandeep_arora
Path Finder
07-03-2017
11:31 AM
Thanks, It's a useful link.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
valerie_tan
Path Finder
03-12-2018
01:30 AM
Hi woodcock, may I know if it is possible to refresh the inline search from the original data source with a click? Does the auto-refresh interval setting actually work on this Inline Search?
Thank you
Get Updates on the Splunk Community!
Aligning Observability Costs with Business Value: Practical Strategies
Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...
Mastering Data Pipelines: Unlocking Value with Splunk
In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...
Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0
Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...
