Splunk Search

how to modify a existing "search" ?

New Member

I create a search called: "poral_app_server", I made a modification to the search string, click "save search" and type in the "portal_app_server" as the "search name". I got the error message: "Unable to create saved search with name 'portal_app_server'. A saved search with that name already exists.". Is that my userid does not have the privilege or I did the process wrong ? I want to replace the existing search "portal_app_server" with my changes. Thanks.

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

Go to Manager > Searches and Reports to edit your search rather than trying to over write your search via the "Save a Search" workflow.

0 Karma