- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- What is an inline Search, How to create one, Impac...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is an inline Search, How to create one, Impact of using it, Any Splunk documentation for inline search.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The term inline search only has context with dashboard XML code. It means that instead of referencing a saved search with search ref you imbed the SPL search string directly inside of the XML. The best documentation on this is here:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Woodcock, I got much clarity from the article.
The search query you shared in the other post is listing all the inline searches executed within a SH Cluster :
https://answers.splunk.com/answers/551415/identify-which-dashboards-are-using-inline-searche.html
It is giving me 2300 search results for inline searches, its just excluding 6 searches may be those were referred as saved searches.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The term inline search only has context with dashboard XML code. It means that instead of referencing a saved search with search ref you imbed the SPL search string directly inside of the XML. The best documentation on this is here:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, It's a useful link.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi woodcock, may I know if it is possible to refresh the inline search from the original data source with a click? Does the auto-refresh interval setting actually work on this Inline Search?
Thank you
A Guide To Cloud Migration Success
Join Us for Splunk University and Get Your Bootcamp Game On!
.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!
