Splunk Search

how to modify a existing "search" ?

New Member

I create a search called: "poral_app_server", I made a modification to the search string, click "save search" and type in the "portal_app_server" as the "search name". I got the error message: "Unable to create saved search with name 'portal_app_server'. A saved search with that name already exists.". Is that my userid does not have the privilege or I did the process wrong ? I want to replace the existing search "portal_app_server" with my changes. Thanks.

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

Go to Manager > Searches and Reports to edit your search rather than trying to over write your search via the "Save a Search" workflow.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...