I am asking because I attempted to use "savedsearch=" as a command after a | tstats much like calling a "datamodel=" , and I now see that the "savedsearch=" is highlighhted as if it should be as if it is an accepted command.
|tstats savedsearch=mysavedsearch
Hi @ericg57 ,
You can run a Report Name
through savedsearch
command. You can make it work like this.
| savedsearch "Report Name"
You can also use tstats in a "Report Name" (ie in the search query of Report) and then call it from savedsearch.
For better understanding of savedsearch=
you can check this doc ... hope this clears your concern
https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Loadjob
Correction: and I now see that the "savedsearch=" is highlighhted as if it should be an accepted command.