If you find that you must repeatedly perform a particular search, you can save it for future use from the Search tab. You can also use saved searches to monitor data trends with the help of dashboards and set notifications that are triggered depending on the threshold set.
You can view, manage, and search for saved searches by using the Saved Searches tab.
This topic contains the following information:
Saving a search
You can save a search (query) to run again in the future.
Name: Provide a name to identify the saved search.
Names of the saved searches must be unique across users. If you try to save a search with a name that already exists, you get an error.
Description: Provide any additional information that you want to add about the saved search.
Time Context: The time context of the search that you performed is automatically displayed. To save the search with the same time context, you can leave this selection unchanged or you can change the time context and save the search with the new time context. You might want to change the time context to monitor your search results more closely.
For example, if you are troubleshooting for an authentication failure error by performing a certain search every week (Last 7 days), then you might want to run this search every 24 hours to monitor the error more closely. For this you need to save the search with a different time context (Last 24 hours).
Saved searches with custom time context cannot be added to dashboards because such saved searches provide absolute results.
If you want the search query to be visible to all users irrespective of their access permissions, select the Make Public check box.
By selecting the Make Public check box, you enable users to view the search query and run it irrespective of their access permissions, but they cannot access the data in the search results unless they have the appropriate permissions.
You can share a saved search with all users irrespective of their user roles. When you share a saved search, users can both view and run the search query. However, they can view the search results only if they have the appropriate permissions. They can also use the shared saved search to add dashlets and notifications.
Select the Make Public check box.
Saved searches imported via a content pack are also treated as public saved searches.
As an app admin or super admin, you can also share saved searches with other users by exporting them in a content pack. However, note that only super admins have the capability of importing content packs.
You can also execute a saved search by selecting a type-ahead search suggestion while typing the search string the search bar.
Dashboards and notifications are based on saved searches. So you need to be careful while changing the search query, if there are dashboards (or notifications) associated with that search query. Dashboards use the saved search context, therefore any change to the time context can affect dashboards associated with the saved search.
You cannot modify a saved search:
However, you can clone the saved search and then customize it as per your needs.
You can delete the saved search that you created. When you delete a saved search, the dashboards and notifications associated with the saved search are also deleted. If a notification contains multiple saved searches and if you delete one of the saved searches used in the notification, then that saved search is removed from the notification.
If you delete a public saved search, a private copy of the saved search is automatically created so that objects configured based on the deleted saved search continue to function. The private copy details are automatically updated in the dependent objects (for example, notifications and dashboards) and are also listed on the Saved Searches page. The user using the saved searches becomes the owner of the private copy. The private copy is named in the following ways based on the source of the public saved search:
You cannot delete public saved searches shared by other users.
You can make a copy of a saved search, modify details if needed, and save it.
You can add a saved search to the dashboard for a graphic representation of the search results data.
Select the saved search that you want to add to the dashboard page, and click Add to Dashboard.
You cannot add a saved search to a dashboard in the following scenarios:
byparameter. Creating a dashlet for such a query does not provide meaningful representation of data.
* | stats count(HOST)
Chart Type: Select one of the following chart types to summarize your search results:
The pie and doughnut charts are not supported for saved searches that return tabular output. For example, timechart command.
You can also create dashboards from the Dashboards tab. For more information, see Managing dashboards.
Select the saved search for which you want to add a notification, and click Create Notification.
While selecting the saved search name, you can specify any portion of the saved search name. You can even specify the content pack name via which the saved search was imported.
For more information, see Creating notifications.
You cannot create a notification for a saved search in the following scenarios:
The Saved Searches tab allows you to view, manage, and search saved searches.
You can perform the following actions on the Saved Searches tab.
Execute the saved search.
|View Saved Search|
View details of the selected saved search.
You can see details such as the name, search query, description, and time context of the saved search. Additionally, you can see whether the saved search is public or not.
|Modify Saved Search|
Edit the selected saved search details.
For more information, see Modifying a saved search.
|Delete Saved Search |
Delete the selected saved search.
For more information, see Deleting a saved search.
|Clone Saved Search|
Make a copy of the selected saved search.
For more information, see Cloning a saved search.
|Add to Dashboard|
Use the saved search to create a dashlet on a dashboard.
For more information, see Adding a saved search to the dashboard.
Use the saved search to create a notification.
For more information, see Creating a notification for the saved search.
|List Notifications and Dashlets|
List the notifications and dashlets in which the existing saved searches are employed.
Search for a saved search by entering a string in the search bar at the top right of your screen.
You can search for a saved search by name, source, and by the search string.
The Saved Searches tab provides the following information:
Name of the saved search configured.
Source can be one of the following:
If the saved search is created by you, then a hyphen (-) is displayed.
Note: Saved searches imported via a content pack are treated as public saved searches.
|Search String||Search query included in the saved search.|
Time range of the search query included in the saved search.
|Public||Displays whether the saved search is public or not, this means whether it is accessible by all users or not.|
View summarization charts added to the dashboard and detect data trends, correlations, or irregularities. For more information, see Managing dashboards.
Create notifications to monitor irregularities and raise alerts or log events. For more information, see Managing notifications.