Oh! great! sed is a very usefull command I add to sourcetype in props.conf SEDCMD = s/PARAM_.*="%.*"//g and template values has been deleted! ... View more

you need to provide the actual search, like so: ./splunk add saved-search -search ' ' -name 'TEST' -schedule ... View more

Solution working in Splunk v7.0 To change an existing report permissions from private to sharing curl -k -u admin:pass https://localhost:8089/servicesNS/{user}/{app}/saved/searches/{search%20name}/acl -d owner={user} -d sharing=app ... View more