I frequently use my 400+ splunk saved reports.   Thus im constantly accessing this url: http://splunkServer.com:8000/en-US/app/search/reports and then type into the search box in the middle (which filters the reports displayed in real-time). Is there any direct url which can search/list my saved reports?  (ie a url that can give me the the same output as typing into the search box in the url above). ie something like  http://splunkServer.com:8000/app/search/saved-reports/reports?q=Cisco (and then ill see any of my saved-reports where report-title matches "Cisco") Im trying to add my splunk saved searches as a "My Search Engines" entry in Chrome browser, such that i can just type into the chrome url bar:   spr <tab> blah (and it will bring me to a page showing any saved reports matching "blah" ). The closest ive been able to pull out is a long splunk url which i can add a search query to, but it returns my saved-reports matches as raw JSON.  thanks ----------- BTW: A super useful, related tip for others: Im already doing this for splunk searches (this= chrome url bar -> splunk search results) via this url below (note the %s at the end, chrome uses %s to fill in what you have typed into the chrome url bar) http://splunkServer.com:8000/en-US/app/search/search?earliest=-4h%40m&latest=now&q=search%20%s (the chrome setting for this is located in:   Settings -> Search Engine -> Manage Search engines -> "Other Search Engines" (Add) ) So using chrome keyword "sp" im able to type into the chrome url bar:   sp <tab> blah and i get the splunk search results for "blah"  for the past 4 hours. (ofcourse i can also do: " sp <tab> index=network blah "  ,  and so on ) thanks ... View more

Im a bit new to deploying forwarders on endpoints i manage (im not new to splunk)- Many guides i see (including the install instructions for this sysmon TA), state that you should deploy this TA onto your forwarders. To do this, the user will need to manually create a outputs.conf file (w indexer IP/dns) and place it in: \TA-microsoft-sysmon\default\ So why is there not a default/blank output.conf file located in \TA-microsoft-sysmon\default\ , from the start? (or even a blank file, with just a #nothing line? I get that the devs dont know the IP / DNS of our indexers). (im not complaining about this , im asking this incase im missing something and so that i can better understand, as it would seem to me a majority of users of this TA will be deploying it on forwarders as well as their indexer- so im wondering why there is not a outputs.conf "place holder"). thanks! ... View more