Splunk Search

How can I extract the exact search string for modified saved searches from events in the _internal index?

bainskaransingh
New Member

Hi All,

I want to list all the saved searches which are modified (action=edit) from the logs, but the exact search string is not visible in the logs. Can some one guide me on how to approach this one?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I believe the search string is not logged on edit, consider using version control.

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi,

It might not fully answer your question but I think it's a good start if you take a look at my answers here:

https://answers.splunk.com/answers/363829/how-can-filter-top-search-in-a-month-with-timefram.html

It was a very long discussion on how to list saved searches and who has been and hasn't been using them in the last two months.
It contains the search string you are looking for.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...