Splunk Search

subsearch and search

cyberpop
Observer

in ES content management, if i click the subsearch, it will bring me to the edit page. but when i click search or view, it display the blank page, where can we find the detail of the search and view?

in ES, can we go to search/search menu and run the subsearch or subsearch has to be runned in content managment as scheduled job? thanks

 

Labels (1)
0 Karma

cyberpop
Observer

also for my saved search, if i go to report, choose open in search window, the search will get executed, is there any way, we can view the spl command of the search without executing the search?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...