- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: What is an inline Search, How to create one, I...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is an inline Search, How to create one, Impact of using it, Any Splunk documentation for inline search.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The term inline search only has context with dashboard XML code. It means that instead of referencing a saved search with search ref you imbed the SPL search string directly inside of the XML. The best documentation on this is here:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Woodcock, I got much clarity from the article.
The search query you shared in the other post is listing all the inline searches executed within a SH Cluster :
https://answers.splunk.com/answers/551415/identify-which-dashboards-are-using-inline-searche.html
It is giving me 2300 search results for inline searches, its just excluding 6 searches may be those were referred as saved searches.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The term inline search only has context with dashboard XML code. It means that instead of referencing a saved search with search ref you imbed the SPL search string directly inside of the XML. The best documentation on this is here:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, It's a useful link.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi woodcock, may I know if it is possible to refresh the inline search from the original data source with a click? Does the auto-refresh interval setting actually work on this Inline Search?
Thank you
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
