Learning, learning, learning . . . Our Splunk "expert" is gone, and the non-programmer gets to learn the task! How do you spell SPLUNK?
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde commented on Michael Wilde's video
Sure... When you do group mapping, map them to groups that don't have the domain admins in them. I have a separate OU=Groups that has "Splunk Users, Splunk Admins, Splunk Power Users" as group names, and specific users…
Mike Hartford commented on Michael Wilde's video
I want to give LDAP access to my splunk servcie but I don't want the LDAP users to have admin capabilitys in Splunk. Can I keep the domain admins out of Splunk if I have LDAP authentication???
Mike Hartford left a comment for Jonathan Hawes
Helow Jonathan,
Glad to have another Splunker. I've been useing Splunk for 2 years and am hooked. I leared how to spell splunk and | transaction too. you'll learn that one soon.
Go over to Splunk…
Mike Hartford commented on Mike Hartford's blog post 'tees for the holy day'
Holy Batskins Ninja, zzzzzwap zgruppp kapow a hidden stash, how great is that!!!!
The team that found them must have special bat senses and highly tooned Splunking skills
I like to wear Extra Lovable…
renaming searches, reports and dashboards
Replies to This Discussion
-
Permalink Reply by Dave P on -
I haven't figured out how to rename them, but I did figure out that if you clone them and give them a new name, it's essentially the same thing. If it's not, I haven't discovered the difference yet.
-dave
-
Permalink Reply by Michael Wilde on -
As of version 4.0.6. It is not possible to rename searches from the UI. However, all of splunk's configs are stored in fairly easy to understand config files. Searches, for example, are stored in "savedsearches.conf" (docs page link). Pop in to that file, edit the stanza name for that search. But where is "savedsearches.conf" stored? It depends.
If you are logged in have created/saved a search, by default it should save to $SPLUNK_HOME/etc/users/$USERNAME/$APPNAME/local/savedsearches.conf.
You can see a search object's sharing settings, which should by private by default (meaning, no other user can see/edit your search).
If you want it to be available to everyone within the app it was created in, such as the "search app" just share it.
Now if i share it, and make it available to users within my "App Context" -- and that app being the "search" app, my configuration for that search will actually move from my "user/local" directory to $SPLUNK_HOME/etc/$APPNAME/local/savedsearches.conf
You will likely have to restart your server if you change this configuration file underneath Splunk. There are a few that do not require a restart--this just isn't one of them.
© 2012 Created by Michael Wilde.
