Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- What is an inline Search, How to create one, Impac...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is an inline Search, How to create one, Impact of using it, Any Splunk documentation for inline search.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The term inline search only has context with dashboard XML code. It means that instead of referencing a saved search with search ref you imbed the SPL search string directly inside of the XML. The best documentation on this is here:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Woodcock, I got much clarity from the article.
The search query you shared in the other post is listing all the inline searches executed within a SH Cluster :
https://answers.splunk.com/answers/551415/identify-which-dashboards-are-using-inline-searche.html
It is giving me 2300 search results for inline searches, its just excluding 6 searches may be those were referred as saved searches.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The term inline search only has context with dashboard XML code. It means that instead of referencing a saved search with search ref you imbed the SPL search string directly inside of the XML. The best documentation on this is here:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, It's a useful link.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi woodcock, may I know if it is possible to refresh the inline search from the original data source with a click? Does the auto-refresh interval setting actually work on this Inline Search?
Thank you
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
