Saved searches and dashboards

Saved searches and dashboards

Before building a dashboard, you may want to create some saved searches. Familiarize yourself with Splunk's search language, create some searches that highlight the important aspects of your data, and then integrate them into dashboards. Dashboards allow you to then visualize data returned from searches in the form of charts, graphs and links. If you are creating Dashboards with Splunk's Dashboard Editor tools, you can run a search to see the results before you save it to the panel you are editing.

Resources for creating searches

If you've never worked with Splunk's search language before, read the User Manual section "Search and investigate." Create searches to highlight the most relevant aspects of your data and support your user's goals. The Search Reference Manual provides additional information on searching with Splunk, including a section on "Best practices", a "Search command cheat sheet", and a complete "Reference to Splunk search commands."

Saved searches and permissions

You can save searches a number of ways:

• Splunk Web
• Splunk Manager
• Search Editor (for saving inline searches using Splunk's Dashboard Editor tools)
• savedsearches.conf in your app or user directory

After saving a search, make sure permissions for the search allow access by users of the dashboard.

You can specify the following for a search:

• Private Only you have access to the search
• Available in an app The search is available only from the app in which it was created
• Available in all apps' Essentially, the search is public.

You can also specify Read and Write permissions, based on user roles.

Save searches from Splunk Web

When saving the search from Splunk Web, specify permissions for the search. You can keep the search private or share the search with other users of the app.

Save searches from Splunk Manager

When creating searches with Splunk Manager, by default the search is private. After creating the search, in Splunk Manager, edit the permissions so users accessing your dashboard can run the search.

1. Select Manager > Searches and reports > New.

2. In the Add new screen, create your search and select Save.

3. In the list of searches, find your newly created search and select Permissions.

4. Specify the following:

Specify:

• Private
• Available in the app in which it was created
• Available in all apps

Also specify Read and Write permissions for user roles.

5. Click Save.

Save searches from the Search Editor

"Create and edit simple dashboards" in the Splunk User Manual describes how to add panels and searches to a dashboard. You can select either a saved search or an inline search for a panel in a dashboard.

If you select an inline search, edit permissions for the dashboard to set permissions for the search. See "Change dashboard permissions" in the User Manual for details.

Saved searches configuration file

When you save a search, Splunk writes information about the search to the savedsearches.conf file.

For private searches, Splunk places savedsearches.conf in your user directory:

$SPLUNK_HOME/etc/users/<user_name>/search/local/savedsearches.conf

For searches saved to an app, Splunk places savedsearches.conf in the following app directory:

$SPLUNK_HOME/etc/apps/<app_name>/local/savedsearches.conf)

• Was this topic useful?
• Post a comment