Create, save, and manage modules
When you create a search, it is created inside an untitled search module. You can use this module as a work area for ad-hoc searches or you can save the module to come back to the searches at a later time.
You can create multiple searches inside a single module and you can create multiple modules.
Creating a module
You create a module inside of a workspace. You can create modules in My workspace, or when you open a workspace in Shared workspaces.
- Open the workspace where you want to create the module.
- Select +Module.
An untitled, empty search module is created and opened in Search. The next step is to add search statements to the module. There are two approaches to adding search statement to a module. See
Saving a module
When you make changes to a module, the module is in draft mode until you save it.
- To save a module, select Save.
- Type a name for the module.
- Optional. Type a description for the module. When you select the module, the description appears in the workspace along with other details about the module.
- Select or create a workspace to store the module in. The default location is My workspace.
- Select Save.
Manage module changes
When you make changes to a module, the changes are not permanent until you save the module.
Draft modules
A module is automatically saved in draft mode when you navigate away from the module. For example, if you access another page in the UI or close the browser window, the module you were working in is automatically saved in draft mode.
When you reopen the module, an asterisk appears next to the module name to indicate that changes you made to the module have not been saved.
For example, My workspace / test*
.
You can either save the module to make the changes permanent or you can discard the changes.
Discarding unsaved changed
You can discard changes to a module, even after you have closed and reopened the module multiple times. When you discard changes, all changes made since you last saved the module are deleted from the module.
You can tell when a module contains unsaved changes. In the navigation bar, there is an asterisk after a module name with unsaved changes. The asterisk is the indicator that the module is in draft mode.
To discard changes made to a module:
- Select the More save options drop-down arrow next to the Save button.
- Select Discard changes.
Sample modules | Creating charts |
This documentation applies to the following versions of Splunk Cloud Platform™: search2preview
Feedback submitted, thanks!