Splunk Cloud Platform

Search Experience preview

This documentation does not apply to the most recent version of Splunk Cloud Platform. For documentation on the most recent version, go to the latest release.

Create, save, and manage modules

When you create a search, it is created inside an untitled search module. You can use this module as a work area for ad-hoc searches or you can save the module to come back to the searches at a later time.

You can create multiple searches inside a single module and you can create multiple modules.

Creating a module

You create a module inside of a workspace. You can create modules in My workspace, or when you open a workspace in Shared workspaces.

  1. Open the workspace where you want to create the module.
  2. Select +Module.

An untitled, empty search module is created and opened in Search. The next step is to add search statements to the module. There are two approaches to adding search statement to a module. See

Saving a module

When you make changes to a module, the module is in draft mode until you save it.

  1. To save a module, select Save.
  2. Type a name for the module.
  3. Optional. Type a description for the module. When you select the module, the description appears in the workspace along with other details about the module.
  4. Select or create a workspace to store the module in. The default location is My workspace.
  5. Select Save.

Manage module changes

When you make changes to a module, the changes are not permanent until you save the module.

Draft modules

A module is automatically saved in draft mode when you navigate away from the module. For example, if you access another page in the UI or close the browser window, the module you were working in is automatically saved in draft mode.

When you reopen the module, an asterisk appears next to the module name to indicate that changes you made to the module have not been saved.

For example, My workspace / test*.

You can either save the module to make the changes permanent or you can discard the changes.

Discarding unsaved changed

You can discard changes to a module, even after you have closed and reopened the module multiple times. When you discard changes, all changes made since you last saved the module are deleted from the module.

You can tell when a module contains unsaved changes. In the navigation bar, there is an asterisk after a module name with unsaved changes. The asterisk is the indicator that the module is in draft mode.

To discard changes made to a module:

  1. Select the More save options drop-down arrow next to the Save button.
  2. Select Discard changes.
Last modified on 15 January, 2023
Sample modules   Creating charts

This documentation applies to the following versions of Splunk Cloud Platform: search2preview


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters