Splunk Cloud Platform

Search Experience preview

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of Splunk Cloud Platform. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Publishing searches

You can share a search statement with other users by exporting the search and publishing the module. The search is published as a view.

A view is a type of dataset that is like a saved search. When you export a search and publish a module, you are not saving the search results as a dataset, instead you are saving the search that generates the dataset.

Other users can import the view into other modules and use the view like any other dataset.

Only searches in a shared workspace module can be exported and published.

When you publish a module, all of the items in the module that have been exported appear in a list. If an exported item has been modified, or removed, the list will indicate those changes.

To publish a search:

  1. Open the module in your shared workspace that contains the search that you want to publish.
  2. Export the search by issuing an export statement. For example, if the name of the search you want to share is $transactions, the export statement is export $transactions.
  3. Save the module.
  4. Near the Save drop-down, select Publish to publish the module. A dialog box shows the location where the search will be published. Any items you have previously published, along with any new exported items are listed.
  5. Select Publish.
  6. From the navigation panel, select Datasets. The published search is listed as a view in the Datasets list.

Export multiple searches

To export multiple searches, enclose the list of searches in curly brackets { }.

For example:

export {$qtr1, $qtr2, $qtr3, $qtr4}

Using published searches

To use a search that someone else has published, you must import the search into a module, either in your My workspace or Shared Workspaces area.

The easiest way to do that is from the Datasets list, which will ensure that the correct location is included in the import statement.

  1. From the navigation pane, select Datasets.
  2. Select the search that you want to import. The published searches are listed in the dataset Kind column as View.
  3. Select the Open in search icon This image shows an icon with an arrow pointing at a 45 degree angle out from a box..

A new module is opened in the My workspace area. The import statement and a new search, using the imported View, are added to the module.

For example:

import transactions from /shared.team_workspace/region_emea

$search = from transactions

Import statement syntax

You can also type the import statement directly into your search module.

The syntax for import statements is:

import <view_name> from /shared.<workspace_name>/<module_name>

For example, suppose the name of the view that you want to import is 3QTR_stats and the name of the shared workspace you want to import the view into is Yearly stats. To import the view into the 2022 module, the import statement is:

import 3QTR_stats from /shared.Yearly stats/2022

See also

Related information
Shared workspaces
Managing collaboration access
Last modified on 09 May, 2023
PREVIOUS
Editing shared modules
  NEXT
Troubleshoot login and access issues

This documentation applies to the following versions of Splunk Cloud Platform: search2preview


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters