Related Answers
Download topic as PDF
savedsearch
Description
Runs a saved search, or report, and returns the search results of a saved search. If the search contains replacement placeholder terms, such as $replace_me$, the search processor replaces the placeholders with the strings you specify. For example:
|savedsearch mysearch replace_me="value"
Syntax
| savedsearch <savedsearch_name> [<savedsearch-options>...]
Required arguments
- savedsearch_name
- Syntax: <string>
- Description: Name of the saved search to run.
Optional arguments
- savedsearch-options
- Syntax: <substitution-control> | <replacement>
- Description: Specify whether substitutions are allowed. If allowed, specify the key-value pair to use in the string substitution replacement.
- substitution-control
- Syntax: nosubstitution=<bool>
- Description: If true, no string substitution replacements are made.
- Default: false
- replacement
- Syntax: <field>=<string>
- Description: A key-value pair to use in string substitution replacement.
Usage
The savedsearch command is a generating command and must start with a leading pipe character.
The savedsearch command always runs a new search. To reanimate the results of a previously run search, use the loadjob command.
Time ranges
- If you specify All Time in the time range picker, the
savedsearchcommand uses the time range that was saved with the saved search.
- If you specify any other time in the time range picker, the time range that you specify overrides the time range that was saved with the saved search.
Examples
Example 1
Run the saved search "mysecurityquery".
| savedsearch mysecurityquery
Example2
Run the saved search "mysearch". Where the replacement placeholder term $replace_me$ appears in the saved search, use "value" instead.
|savedsearch mysearch replace_me="value"...
See also
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the savedsearch command.
|
PREVIOUS run |
NEXT script |
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.10, 6.4.11, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 8.0.0, 8.0.1, 8.0.2, 6.4.9, 6.5.0, 6.5.1
Comments
Please specify on this page whether the results from the search's most recent run are used if the time is left at All Time, or if the search is re-run regardless of whether their are substitutions.
Thanks for the suggestion Woodcock.
I have added it to the See also section.
You should add "Loadjob" to the "See also" section.
Hello Landen99, thank you for your comment.
The savedsearch command always runs a new search. To use the results of a previously run search, use the loadjob command.
If you specify All Time in the time range picker, the savedsearch command uses the time range that was saved with the saved search. If you specify any other time in the time range picker, the time range that you specify overrides the time range that was saved with the saved search.
I have updated the Usage section of this topic to explain what happens.