Splunk Search

how to modify a existing "search" ?

laughterjj
New Member

I create a search called: "poral_app_server", I made a modification to the search string, click "save search" and type in the "portal_app_server" as the "search name". I got the error message: "Unable to create saved search with name 'portal_app_server'. A saved search with that name already exists.". Is that my userid does not have the privilege or I did the process wrong ? I want to replace the existing search "portal_app_server" with my changes. Thanks.

Tags (2)
0 Karma

araitz
Splunk Employee
Splunk Employee

Go to Manager > Searches and Reports to edit your search rather than trying to over write your search via the "Save a Search" workflow.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...