How saved searches work
This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.0.1 , 3.0.2 , 3.1 , 3.1.1 , 3.1.2 , 3.1.3 , 3.1.4
Contents
How saved searches work
Saved searches
Saved searches are search strings that have been saved for re-use. Saving a search allows for useful and lengthy strings to be captured by Splunk. Splunk ships with a few pre-configured, useful saved searches:
- Daily indexing volume
- Errors in the last 24 hours
- Kbps indexed per hour last 24 hours
- Messages by minute last 3 hours
- Splunk errors last 24 hours
- all
Saved searches may be saved to share or be saved as private. Shared and personally owned private saved searches appear by default on the bottom landing page:
Saved searches allow for knowledge capture and sharing. Splunk administrators can create saved searches to distribute to all their Splunk users. You may wish to share saved searches via SplunkBase, or distribute them as bundles to other systems in your data center. Learn more about bundle files.
Alerting
Any saved search can be set to run on a specific schedule, trigger alerts, send emails or RSS feeds. Learn more about setting up alerts.
For more advanced configuration, alerts can be set up to run via cron-like notation.
Alerts can also be configured to trigger shell scripts. This is one way to configure Splunk to work with other applications. Two examples include sending SNMP traps and sending syslog events