Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Sideview SavedSearch module doesn't ssave the search

$
0
0

I'm probably missing something pretty basic, but when I put the Sideview SearchControls module into a view and save the search, the savedsearches.conf entry created looks like this:

[PopRedstonr]
action.email.reportServerEnabled = 0
alert.track = 0
displayview = CombinedDetail
request.ui_dispatch_view = CombinedDetail
search = *

Here is the XML (more or less - mostly less)

<view>
 <blablabla/>
     <module name="SearchControls">
      <param name="sections">export print saveMenu createMenu </param> 
      <param name="jobControls">pause cancel</param> 
      <param name="saveMenu">saveSearch saveResults saveAndShareResults</param> 
      <param name="createMenu">createAlert createScheduledSearch</param>

          <stuff>
          The rest of my view XML
          Search, table, redirector, etc.
          </stuff>
      </module>
  </view>

If I run the same search in the search app and save it I get the search in my savedSearches.conf and it looks like this:

[PopRedstonr]
action.email.reportServerEnabled = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
auto_summarize.timespan = 1m
dispatch.earliest_time = 0
displayview = flashtimeline
request.ui_dispatch_view = flashtimeline
search = index="fbo" sourcetype="fboTEMPLATE" "*POP*Redstone*"\
| spath output=Date path=TEMPLATE.DATE\
| spath output=Record path=TEMPLATE.RECNUM\
| spath output=Subject path=TEMPLATE.SUBJECT\
| spath output=Location path=TEMPLATE.POPADDRESS\
| eval Date= strptime(Date,"%m%d%Y") \
| convert timeformat="%Y-%m-%d"  ctime(Date) AS Date\
| table Date, Record, Location, Subject\
| sort Date desc
vsid = hq73cul2

Why am I getting only an asterisk instead of the search text in my view?


Viewing all articles
Browse latest Browse all 13053

Trending Articles