Splunk® IT Essentials Work

Entity Integrations Manual

Activate or deactivate saved searches from content packs

The guided setup for the content packs enables you to activate or deactivate all the saved searches of the content packs.

Prerequisites

You must have the admin or itoa_admin role to activate or deactivate the saved searches of the content packs.

Roles for activating and deactivating saved searches

Refer to following table to identify which role is required to activate or deactivate saved searches of the content pack.

Content pack Role that activates / deactivates saved searches
Splunk App for Content Packs version 1.9.0 or earlier admin
Splunk App for Content Packs version 2.0.0 or later itoa_admin, admin
Custom Content Pack created in ITSI version 4.16.0 (Created using "Content Authorship") admin
Custom Content Pack created in ITSI version 4.17.0 (Created using "Content Authorship") itoa_admin, admin

All the saved searches of Splunk App for Content Packs version 2.0.0 are deactivated by default.

Content Pack lister page

Content pack tiles now display the status of saved searches.

Saved search status will not be displayed if the content pack does't have any saved searches.

Saved search status can be in one of the following states:

  • All Saved Searches activated: This text displays if all the Saved Searches of the content pack are activated.
  • All Saved Searches deactivated: This text displays if all the Saved Searches of the content pack are deactivated.
  • X/Y Saved Searches deactivated: This text displays when some (but not all) of the saved searches are deactivated (where X is the number of saved searches in a deactivated state and Y is the total number of saved searches in the content pack).

In addition, ITSI shows tiles for the following four content packs that do not have ITE Work or ITSI objects, but only have saved searches. ITSI users can perform actions on the saved searches of these content packs as well:

  • ITE Work Alert Routing
  • NetApp Data ONTAP Dashboards and Reports
  • Unix Dashboards and Reports
  • VMware Dashboards and Reports

The following screenshot shows a representative content pack lister page.

Content pack tiles and saved search status example

ITE Work users now see tiles for following five additional content packs that have saved searches only. ITE Work users can perform actions on the saved searches of these content packs as well:

  • ITE Work Alert Routing
  • NetApp Data ONTAP Dashboards and Reports
  • Unix Dashboards and Reports
  • VMware Dashboards and Reports
  • ITSI Monitoring and Alerting

The following screenshot shows tiles and saved search notations for featured content packs in ITE Work. ITE Work content pack tiles

Modify status of saved searches of the content pack

Users can modify the status of saved searches of any content pack from the guided setup for installation. The following options are visible in the guided setup for content packs having saved searches:

  • Activate all saved searches: This option activates all of the saved searches of the content pack.
  • Deactivate all saved searches: This option deactivates all of the saved searches of the content pack.
  • Retain current status of saved searches: This option keeps the status of the saved searches as is.

Content packs with saved searches and ITE Work/ITSI objects

In content packs that have saved searches and ITE Work or ITSI objects, the "Modify status of saved searches" option is displayed in the 4th position of the guided setup for installation, as shown in the following screenshot:

Guided setup partial screen showing highlight around Modify status of saved searches

When the installation completes, users can view all objects that were successfully installed and the status of the saved searches, as shown in the following example.

Example of saved search status listed after successful installation

Status of saved searches will only be visible if you select the Activate or Deactivate option of saved searches.

Content packs that only have saved searches

In content packs that have saved searches but no ITE Work or ITSI objects, only "Modify status of saved searches" option is displayed by the guided setup for installation, as the following example from installation of the content pack for NetApp Data ONTAP Dashboards and Reports shows:

Modify status of saved searches option when there are no ITEW or ITSI objects

When the installation completes, you can view the status of the saved searches, as shown in the following example.

Example saved search listing

Status of saved searches will only be visible if you select the Activate or Deactivate option of saved searches.

Last modified on 28 February, 2024
CreateContentPacks   Create a single entity in ITE Work

This documentation applies to the following versions of Splunk® IT Essentials Work: 4.18.0, 4.18.1, 4.19.0, 4.19.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters