Related Answers
Download topic as PDF
savedsearch
Description
Runs a saved search, or report, and returns the search results of a saved search. If the search contains replacement placeholder terms, such as $replace_me$, the search processor replaces the placeholders with the strings you specify. For example:
|savedsearch mysearch replace_me="value"
Syntax
| savedsearch <savedsearch_name> [<savedsearch-options>...]
Required arguments
- savedsearch_name
- Syntax: <string>
- Description: Name of the saved search to run.
Optional arguments
- savedsearch-options
- Syntax: <substitution-control> | <replacement>
- Description: Specify whether substitutions are allowed. If allowed, specify the key-value pair to use in the string substitution replacement.
- substitution-control
- Syntax: nosubstitution=<bool>
- Description: If true, no string substitution replacements are made.
- Default: false
- replacement
- Syntax: <field>=<string>
- Description: A key-value pair to use in string substitution replacement.
Usage
The savedsearch command is a generating command and must start with a leading pipe character.
The savedsearch command always runs a new search. To reanimate the results of a previously run search, use the loadjob command.
Time ranges
- If you specify All Time in the time range picker, the
savedsearchcommand uses the time range that was saved with the saved search.
- If you specify any other time in the time range picker, the time range that you specify overrides the time range that was saved with the saved search.
Examples
Example 1
Run the saved search "mysecurityquery".
| savedsearch mysecurityquery
Example2
Run the saved search "mysearch". Where the replacement placeholder term $replace_me$ appears in the saved search, use "value" instead.
|savedsearch mysearch replace_me="value"...
See also
|
PREVIOUS run |
NEXT script |
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.10, 6.6.9, 6.6.11, 6.6.12, 7.0.1, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 7.0.0, 7.0.11, 7.0.13, 7.0.2
Feedback submitted, thanks!