can i edit "Searches and reports" throgh file?

[perlish]

i want edit "Searches and reports" to add some search, but through web ui to add is very slowly,
wheather i can add it through add some file? like "dashboard and views", i can edit it through edit xml file.

[MHibbin]

Yes, is the answer basically, searches can be edited/added via the "savedsearches.conf" file located in the $SPLUNK_HOME/etc/apps/<yourApp>/local directory (or $SPLUNK_HOME/etc/system/local or $SPLUNK_HOME/etc/users/<userName>/<appName>/local directories)

Remember to back files edited vai the CLI just in case something goes wrong 🙂 (best practice #1 IMHO)

Regards,

MHibbin

[Mahieu]

Yes you can.
Dpending on the application you want to create the dashboard in, go to :

/opt/splunk/etc/apps//local/data/ui/views

Then create or edit a .xml file.