Hi according to the suggestion, I have tried out and successfully getting the expected behavior that only "admin" role users can have the options to do "Open in Search"/"Export" and etc... Amend the SPL search accordingly to what you desire to achieve <!-- Running searches and gaining role value for current user --> <search> <query>| rest /services/authentication/current-context | search username!=splunk-system-user | fields roles </query> <earliest>-15m</earliest> <latest>now</latest> <done> <eval token="search_visible">if($result.roles$=="admin","true","false")</eval> </done> </search> <!-- Running searches and gaining role value for current user --> <!-- selectively disable only exporting fucntion --> <!-- admin role can export, other roles can't  etc etc..--> <option name="link.exportResults.visible">$search_visible$</option> ... View more

You should able to do that with enclosing your field name with dollar sign ($) $Application Server$="running" Refer to: https://community.splunk.com/t5/Splunk-Search/Search-field-names-with-spaces-in-map-command-inner-search/m-p/241379#M71778 ... View more

Here is my sample. I want to get all saved search then from the returned result I want to filter in the field called "search" to find searchstring that contains something like "| collect". So     | where (search LIKE "%| collect%")   do the job Full Search String:   | rest /servicesNS/-/-/saved/searches | table title, cron_schedule next_scheduled_time eai:acl.owner actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search | where (search LIKE "%| collect%") Add-On Let's say I want to filter search a field called "action.summary_index" for the value equals to 1, I can do as below. Enclose the field name with dollar sign ($) | rest /servicesNS/-/-/saved/searches | table title, cron_schedule next_scheduled_time eai:acl.owner actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search * | where $action.summary_index$ = "1"   ... View more

I use a workaround. Background of what I did: I am writing a bash script, to create Splunk diag using splunk user and move the diag file to the desired folder of mine. [root@myserver ~]# vi test_script.sh sudo -i -u splunk bash << EOF # Create Splunk Diagnostic Report /opt/splunk/bin/splunk diag > /opt/splunk/mylog.log EOF # Use grep to extract the path from the output diag_path=$(cat /opt/splunk/mylog.log | grep -oP '(?<=Splunk diagnosis file created: )/.*\.tar\.gz') echo $diag_path # Check if the path is not empty if [ -n "$diag_path" ]; then      # Copy the file to /root/mydesiredfolder      mv "$diag_path" /root/mydesiredfolder      echo "File copied successfully to /root/mydesiredfolder" else      echo "Path not found or command did not generate the expected output" fi # Cleanup rm /opt/splunk/mylog.log ########## The idea behind it is when running ./splunk diag, it will have the output of something like this Splunk diagnosis file created: /opt/splunk/diag-servername-2023-12-22_08-19-01.tar.gz ... View more

Hi, If anyone come across this thread, could refer to Option 2 in this thread  "How to store results of searches in Dashboard?"  in order to achieve something similar. Build Report with loadjob  from "Saved Scheduled Search(es)". loadjob "Loads events or results of a previously completed search job. The artifacts to load are identified either by the search job id <sid> or a scheduled search name and the time range of the current search. If a saved search name is provided and multiple artifacts are found within that range, the latest artifacts are loaded." Happy Splunking! ... View more