If I have saved my searches globally, ie in the file
$SPLUNK_HOME/apps/search/local/savedsearches.conf
is it then possible to reload changes somehow?
I have tried several restart/reload options but none seem to work.
Obviously if I edit them in the GUI, they will be reloaded but I have changed names to them and would like the new names to appear.
This works for my app savedsearches.conf too.
I mean the web link works for my app's savedsearches.conf
You can use this command to reload the saved searches:
splunk _internal call "/admin/savedsearch/_reload"
or via Splunkweb visit the URI /debug/refresh?entity=admin/savedsearch
eg. http://localhost:8000/debug/refresh?entity=admin/savedsearch
How do I reload the savedsearch.conf for my specific app?
The internal call needed to like this: splunk _internal call /servicesNS/admin/search/admin/savedsearch/_reload -auth username
to work. But the web link was useful, it reloads everything. https://servername/en-US/debug/refresh