Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
907 results
Sort by:
02-15-2024
06:09 AM
Hi! We recently decided to move from Splunk on-prem to Cloud. Is there any quick way for me to upload my savedsearches.conf file from the On-Prem to the Cloud instance? I am l...
- Tags:
- cloud
- savedsearch
Labels
- Labels:
-
using Splunk Cloud
03-14-2024
09:11 AM
....conf file, like: [Server*_Monitoring] dispatch.ttl=3p I restarted the search head after the change, but it didn't work. Is there any way to avoid listing all the searches explicitly in savedsearches...
- Tags:
- conf
- savedsearch
Labels
- Labels:
-
administration
-
configuration
02-06-2023
05:28 AM
1 Karma
...PLUNK_HOME$/etc/apps/<appname>/default/savedsearches.conf. - For version control / code management, I want to split this single savedsearches.conf into multiples savedsearches.conf files so that d...
Labels
- Labels:
-
other
07-30-2020
11:13 PM
...LI. If someone tampered with the savedsearches.conf file I'd like to audit those changes somewhere. Is there a straightforward way? I was thinking of file monitor of the file in Splunk and raise an a...
Labels
10-09-2012
04:28 AM
6 Karma
...ince there are a lot of those, I prefer to do it in the shell:
cd etc/apps/webintelligence
egrep '^(cron.*|\[.*\])$' default/savedsearches.conf | \
egrep -B 1 'cron_schedule = 0(\ \*){4}' | \
p...
06-09-2021
07:34 AM
...ispatch.ttl" in the Spunk documentation for savedsearches.conf, where it states: dispatch.ttl = <integer>[p]
* Indicates the time to live (ttl), in seconds, for the artifacts of the
scheduled s...
- Tags:
- saved search
Labels
- Labels:
-
other
02-07-2020
08:04 AM
Just adding the below stanza wuld be sufficient to disable a saved search in default/savedsearches.conf
disabled = 1
How can I disable or enable a saved search in splunk from config side.
I...
Labels
- Labels:
-
saved search
10-03-2011
11:01 AM
Hi,
I've following entry in my savedsearches.conf:
[My_Summary_Query]
action.email.inline = 1
action.email.reportServerEnabled = 0
action.summary_index = 1
action.summary_index._name = `M...
- Tags:
- splunk
04-04-2012
01:32 PM
...o select in the last 4 hrs, 8 hrs etc.. The search is defined in savedsearches.conf. And I am looking for a way to pass in the selected time parameter to the saved search. Please
- Tags:
- savedsearches
