Splunk Search

subsearch and search

cyberpop
Observer

in ES content management, if i click the subsearch, it will bring me to the edit page. but when i click search or view, it display the blank page, where can we find the detail of the search and view?

in ES, can we go to search/search menu and run the subsearch or subsearch has to be runned in content managment as scheduled job? thanks

 

Labels (1)
0 Karma

cyberpop
Observer

also for my saved search, if i go to report, choose open in search window, the search will get executed, is there any way, we can view the spl command of the search without executing the search?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...