Splunk Search
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: What is an inline Search, How to create one, I...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gagandeep_arora
Path Finder
07-03-2017
10:55 AM
What is an inline Search, How to create one, Impact of using it, Any Splunk documentation for inline search.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
woodcock
Esteemed Legend
07-03-2017
11:02 AM
The term inline search only has context with dashboard XML code. It means that instead of referencing a saved search with search ref you imbed the SPL search string directly inside of the XML. The best documentation on this is here:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gagandeep_arora
Path Finder
07-03-2017
11:31 AM
Thanks Woodcock, I got much clarity from the article.
The search query you shared in the other post is listing all the inline searches executed within a SH Cluster :
https://answers.splunk.com/answers/551415/identify-which-dashboards-are-using-inline-searche.html
It is giving me 2300 search results for inline searches, its just excluding 6 searches may be those were referred as saved searches.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
woodcock
Esteemed Legend
07-03-2017
11:02 AM
The term inline search only has context with dashboard XML code. It means that instead of referencing a saved search with search ref you imbed the SPL search string directly inside of the XML. The best documentation on this is here:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gagandeep_arora
Path Finder
07-03-2017
11:31 AM
Thanks, It's a useful link.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
valerie_tan
Path Finder
03-12-2018
01:30 AM
Hi woodcock, may I know if it is possible to refresh the inline search from the original data source with a click? Does the auto-refresh interval setting actually work on this Inline Search?
Thank you
Get Updates on the Splunk Community!
Good Sourcetype Naming
When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...
See your relevant APM services, dashboards, and alerts in one place with the updated ...
As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...
Splunk App for Anomaly Detection End of Life Announcement
Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...
