I want to learn how to create a saved search - as appears in savesearches.conf. My end goal is to use a saved search to populate a lookup table.
Apparently, there is no documentation (I searched the docs for "saved search" -- no results) so I wondered if anyone knows how to do this. In the Search app, I see the link "Save As", but it looks like I can only save a Report, Dashboard Panel, Alert, or Event Type. Are those all saved searches? I saved a search, but savedsearches.conf was not modified.
Save as Report creates a saved search.
savedsearches.conf
is created/modified in etc/apps/your_app/local
folder, where your_app
is the application context where you created and saved the search. In your case, it's most probably search
. So look in $SPLUNK_HOME/etc/apps/search/local
.
Save as Report creates a saved search.
savedsearches.conf
is created/modified in etc/apps/your_app/local
folder, where your_app
is the application context where you created and saved the search. In your case, it's most probably search
. So look in $SPLUNK_HOME/etc/apps/search/local
.
Ahh yes and in Settings -> Searches, reports, and alerts
, if the permissions are set to "Private", the search goes to etc/users/<user>/search/local/savedsearches.conf instead. Thank you!