I'm not aware of a way to do what you are describing. Since you've already specified index=x in the first part of your search, there isn't a way to go-back and re-search index=y OR index=z instead of index=x in the second part. You'll probably want to do a find/replace on savedseaches.conf. The local level one is at: /opt/splunk/etc/apps/YOURAPP/local/savedsearches.conf Although, if you are going to touch every search, you might want to create event types first, and then change "index=x" to "eventtype=x" in all of your searches, so that future changes are less invasive. More about event types here: http://www.splunk.com/view/SP-CAAAGYK ... View more