If you find that you must repeatedly perform a particular search, you can save it for future use from the Search tab. You can also use saved searches to monitor data trends with the help of dashboards and set notifications that are triggered depending on the threshold set.
You can view, manage, and search for saved searches by using the Saved Searches tab.
This topic contains the following information:
You can save a search (query) to run again in the future.
Name: Provide a name to identify the saved search.
Note
Names of the saved searches must be unique across users. If you try to save a search with a name that already exists, you get an error.
Time Context: The time context of the search that you performed is automatically displayed. To save the search with the same time context, you can leave this selection unchanged or you can change the time context and save the search with the new time context. You might want to change the time context to monitor your search results more closely.
For example, if you are troubleshooting for an authentication failure error by performing a certain search every week (Last 7 days), then you might want to run this search every 24 hours to monitor the error more closely. For this you need to save the search with a different time context (Last 24 hours).
Note
Saved searches with custom time context cannot be added to dashboards because such saved searches provide absolute results.
If you want the search query to be visible to all users irrespective of their access permissions, select the Make Public check box.
Note
By selecting the Make Public check box, you enable users to view the search query and run it irrespective of their access permissions, but they cannot access the data in the search results unless they have the appropriate permissions.
You can share a saved search with all users irrespective of their user roles. When you share a saved search, users can both view and run the search query. However, they can view the search results only if they have the appropriate permissions.
Select the Make Public check box.
Tip
You can also execute a saved search by selecting a type-ahead search suggestion while typing the search string the search bar.
Dashboards and notifications are based on saved searches. So you need to be careful while changing the search query, if there are dashboards (or notifications) associated with that search query. Dashboards use the saved search context, therefore any change to the time context can affect dashboards associated with the saved search.
Note
You cannot modify a saved search:
You can delete the saved search that you created. When you delete a saved search, the dashboards and notifications associated with the saved search are also deleted.
Note
You cannot delete a saved search shared by others.
You can make a copy of a saved search, modify details if needed, and save it.
Note
If you want to add a dashboard or a notification using a saved search marked as public, then you must first clone it.
You can add a saved search to the dashboard for a graphic representation of the search results data.
Select the saved search that you want to add to the dashboard page, and click Add to Dashboard
.Note
You cannot add a saved search to a dashboard in the following scenarios:
by
parameter. Creating a dashlet for such a query does not provide meaningful representation of data.* | stats count(HOST)
However, you can use a saved search shared by another user for creating a dashboard after cloning the saved search.
Chart Type: Select one of the following chart types to summarize your search results:
Chart type | Preview |
---|---|
Bar | |
Column | |
Doughnut | |
Line | |
Pie |
Note
The pie and doughnut charts are not supported for saved searches that return tabular output. For example, timechart command.
You can also create dashboards from the Dashboards tab. For more information, see Managing dashboards.
Select the saved search for which you want to add a notification, and click Create Notification
.For more information, see Creating notifications.
Note
You cannot create a notification for a saved search in the following scenarios:
However, you can use a saved search shared by another user for creating a dashboard after cloning the saved search.
View summarization charts added to the dashboard and detect data trends, correlations, or irregularities. For more information, see Managing dashboards.
Create notifications to monitor irregularities and raise alerts or log events. For more information, see Managing notifications.