Publishing searches
You can share a search statement with other users by exporting the search and publishing the module. The search is published as a view.
A view is a type of dataset that is like a saved search. When you export a search and publish a module, you are not saving the search results as a dataset, instead you are saving the search that generates the dataset.
Other users can import the view into other modules and use the view like any other dataset.
Only searches in a shared workspace module can be exported and published.
When you publish a module, all of the items in the module that have been exported appear in a list. If an exported item has been modified, or removed, the list will indicate those changes.
To publish a search:
- Open the module in your shared workspace that contains the search that you want to publish.
- Export the search by issuing an export statement. For example, if the name of the search you want to share is
$transactions
, the export statement isexport $transactions
. - Save the module.
- Near the
Save
drop-down, selectPublish
to publish the module. A dialog box shows the location where the search will be published. Any items you have previously published, along with any new exported items are listed. - Select
Publish
. - From the navigation panel, select Datasets. The published search is listed as a view in the Datasets list.
Export multiple searches
To export multiple searches, enclose the list of searches in curly brackets { }.
For example:
export {$qtr1, $qtr2, $qtr3, $qtr4}
Using published searches
To use a search that someone else has published, you must import the search into a module, either in your My workspace or Shared Workspaces area.
The easiest way to do that is from the Datasets list, which will ensure that the correct location is included in the import statement.
- From the navigation pane, select Datasets.
- Select the search that you want to import. The published searches are listed in the dataset Kind column as
View
. - Select the Open in search icon .
A new module is opened in the My workspace area. The import statement and a new search, using the imported View, are added to the module.
For example:
import transactions from /shared.team_workspace/region_emea $search = from transactions
Import statement syntax
You can also type the import statement directly into your search module.
The syntax for import statements is:
import <view_name> from /shared.<workspace_name>/<module_name>
For example, suppose the name of the view that you want to import is 3QTR_stats
and the name of the shared workspace you want to import the view into is Yearly stats
. To import the view into the 2022
module, the import statement is:
import 3QTR_stats from /shared.Yearly stats/2022
See also
- Related information
- Shared workspaces
- Managing collaboration access
Editing shared modules | Troubleshoot login and access issues |
This documentation applies to the following versions of Splunk Cloud Platform™: search2preview
Feedback submitted, thanks!