Saved Searches: the feature that turns a one-time search into a reusable tool you can run on demand or on a schedule. Without saved searches, you would retype the same Splunk query every time you needed a weekly report or a security alert. For the SPLK-1003 exam, knowing how to create, manage, and use saved searches is essential because it moves you from ad-hoc searching to automated reporting — a core skill for a Power User.
Jump to a section
A simple way to picture Saved Searches Basics
Meet Priya, the office manager at a busy dental practice. Every morning, she runs the same report: a list of patients who haven't visited in over a year, sorted by their last appointment date. Instead of flipping through paper files each time, she saves the exact search steps in her notebook. That notebook is her "saved search."
Priya's saved search has a name — "Overdue Patients 12 Months" — and she can run it with one click. She can also schedule it: every Monday at 8 AM, the report prints automatically. If she wants to see only patients in a specific postal code, she can open her notebook, tweak the filter, and run a modified version without starting from scratch.
One day, Priya shares her notebook with a colleague. The colleague sees exactly which criteria Priya uses and can run the same report independently. This saves hours of repetitive work and ensures consistency. Just like in Splunk, a saved search captures the query logic, not just the results — so anyone with permission can reproduce it exactly, anytime, without needing to remember the steps.
In Splunk, a saved search is exactly what it sounds like: a search query that you save so you can run it again later without retyping it. When you save a search, Splunk stores the search string, the time range, and any settings you applied (like acceleration or permissions). This is different from just bookmarking a results page — a saved search re-executes the query, so you always get fresh data.
Why does this matter? In a real IT environment, people run the same searches over and over. For example, a security analyst might check every morning for failed login attempts in the last 24 hours. Instead of typing index=main sourcetype=linux_secure "failed password" and picking a time range manually each time, they save that search once. Then every morning, they open it, click run, and get the latest results in seconds.
Saved searches are the foundation of several important Splunk features:
Reports: When you save a search as a report, you can visualise the results as a chart or table. Saved searches are the raw query; reports add formatting and display options.
Alerts: A saved search can be converted into an alert that triggers an action (like sending an email) when results match certain conditions.
Dashboards: Dashboard panels are often powered by saved searches, so dashboard content updates automatically as new data comes in.
To create a saved search, you first run a search in the Search & Reporting app. Once you're happy with the results, click the "Save As" button and choose "Search". Give it a name — something descriptive like "Failed Logins - Last 24h" — and optionally add a description. You can also set a time range picker so that when you run the search later, it applies the same range (e.g., "Last 24 hours") automatically.
After saving, you manage your saved searches from the "Searches, Reports, and Alerts" page under Settings. Here, you can edit the search string, change permissions, schedule the search to run automatically, and even accelerate the search for faster performance on large datasets. Acceleration creates a summary index that pre-computes the results for common time buckets, making repeated runs much faster.
One key concept is the difference between a saved search and a report. A saved search is exactly the query. A report is a saved search that has been formatted — it chooses what to display (table, chart, statistics) and how to display it. When you save a search as a report, Splunk actually creates both a saved search and a report object linked to it.
Permissions matter: you can share saved searches with specific roles, users, or everyone. By default, only you and users with admin roles can see your saved search. For team projects, you should set permissions to "App" level so all team members with access to the app can use it.
Another powerful feature is scheduled saved searches. Instead of running a search manually, you can set a schedule — for example, every hour, daily at midnight, or every Monday at 9 AM. The scheduled search runs in the background, and you can configure it to trigger an alert or update a dashboard. This is how real-time monitoring works in Splunk: a scheduled saved search continuously checks for conditions and notifies you when something interesting happens.
Finally, when you delete a saved search, you remove only the query definition — any reports or alerts that depend on it will break and need to be reassigned. So always check dependencies before deleting.
Run your search
Open Splunk Search & Reporting, type your query into the search bar, select the appropriate time range, and run it. Verify the results look correct before saving.
Click 'Save As' and choose 'Search'
This opens the save dialog. You must decide whether to save as a search (query only) or a report (query plus visualisation). For the exam, remember that reports are an extension of saved searches.
Name and describe your saved search
Give it a descriptive, unique name that reflects its purpose, e.g., 'Failed Logins - Last Hour'. Add a description for context. This matters when you have dozens of saved searches in an app.
Configure time range and acceleration
Set the time range input to 'Auto' or a specific relative range. Enable acceleration if the search runs on large datasets repeatedly. Acceleration pre-computes results for faster execution.
Set permissions and schedule
Share the search with your team by setting permissions to 'App' level. Optionally schedule the search to run automatically — for example, every 15 minutes for a monitoring alert.
Save and verify
Click 'Save'. Then find the saved search under 'Searches, Reports, and Alerts' in Settings. Run it again to confirm it works as expected. Check that the schedule, if set, triggers correctly.
Imagine you work as a junior IT analyst at a mid-sized e-commerce company. The company uses Splunk to monitor its web servers, application logs, and security events. Every Monday morning, your manager asks for a report: "How many 500 Internal Server Errors did we get last week, broken down by server?"
Without saved searches, you would log into Splunk, type index=web sourcetype=access_combined status=500, set the time range to "Last 7 days", click search, wait for results, then manually copy the data into a spreadsheet and create a chart. You do this every week. It takes 15 minutes each time. One Friday, you're off sick, and Monday the report doesn't get done. That's a problem.
With saved searches, the process looks different. You create a saved search called "500 Errors - Weekly by Server" with this query: index=web sourcetype=access_combined status=500 | stats count by host. You save it with a time range of "Last 7 days" and set permissions so everyone in your team can use it.
Now, here's what happens step by step:
Monday morning: you open the saved search, click "Run", and get the results in under a minute.
You click "Save As Report" and choose a bar chart format. The report is now available on your team's dashboard.
You schedule the report to run automatically every Monday at 7 AM. Now, even if you're on holiday, the report updates itself.
Your manager can access the report directly from the dashboard without asking you.
If you need to modify the search later — say, you want to filter out a specific test server — you edit the saved search once, and all reports and dashboards using it update automatically.
Beyond reporting, you also use saved searches for ad-hoc troubleshooting. One afternoon, a customer reports a slow checkout process. You suspect a specific API endpoint is failing. You run a quick search, find the issue, and save it as "Checkout API Errors" so you can monitor it again tomorrow.
The real value is consistency: every time someone runs the saved search, they get results based on the same logic. There's no variation from one person to another, and no chance of mis-typing the query. This is critical for compliance and auditing, especially in regulated industries.
You also learn to use the "Schedule" feature for proactive monitoring. For example, a saved search that counts failed SSH logins every hour. If the count exceeds a threshold, an alert triggers an email to the security team. This saved search is the heart of your company's intrusion detection setup.
The SPLK-1003 exam tests saved searches mainly in the context of creating and using them for reporting. You won't need to memorise every button, but you must understand the core concepts and common decision points.
Here are the specific topics the exam likes to quiz:
The difference between a saved search and a report: A saved search is the query. A report is the query plus formatting/visualisation. The exam often presents a scenario and asks whether you should save as a search or as a report. The answer is: if you only need the raw data, save as search. If you need a chart or table for a dashboard, save as report.
How to share a saved search: The exam tests your knowledge of permissions. You'll see a question like, "A team member cannot see your saved search. What should you do?" The answer usually involves setting permissions to "App" level or granting read access to the appropriate role.
Scheduled searches: They ask about scheduling options — daily, hourly, cron expressions — and what happens if a scheduled search is disabled or deleted. Remember that disabling a scheduled search stops it from running, but the search definition remains.
Acceleration: Questions about search acceleration and summary indexing. They test whether you know that acceleration makes repeated runs faster by pre-computing results, and that it works best on time-based searches.
Traps to watch for:
Trap: Confusing saved searches with dashboards. A dashboard is a collection of panels, each of which may use a saved search. The saved search is the underlying query, not the dashboard itself.
Trap: Thinking that deleting a saved search deletes its results. It only deletes the query definition. Results are not stored by the saved search — they come from the index each time.
Trap: Assuming all saved searches are visible to everyone by default. They are private unless shared.
Trap: Mixing up the "Save As" vs "Save" buttons. "Save As" creates a new saved search. "Save" saves changes to an existing one.
Key definitions to memorise:
Saved search: A stored search query with a name, description, time range, and settings.
Report: A saved search with visualisation options (chart type, label, etc.).
Alert: A saved search that triggers an action based on a condition.
Acceleration: A feature that pre-computes results for faster execution.
Schedule: A time-based trigger that runs a saved search automatically.
Practice questions will often give you a search string and ask you to identify which part is the search itself versus the time range or the reporting command. Another common trap: they present a scenario where a user wants to reuse a search but change the time range each time. The correct answer is to set the time range to "Real-time" or use a relative time range (like "Last 60 minutes") so the user can override it manually.
Finally, expect at least one question about the order of operations when running a saved search: Splunk first checks permissions, then runs the query against the index, then applies any post-processing (like stats or timechart commands), and finally returns the results. Understanding that order helps you troubleshoot why a saved search might return unexpected data.
A saved search stores the query and settings, not the data — results are always fresh from the index.
Reports are saved searches with visual formatting; a report depends on the underlying saved search.
You can schedule a saved search to run automatically at a set interval for proactive monitoring.
Permissions on saved searches default to private — you must explicitly share them with the team or app.
Deleting a saved search breaks any alerts or reports that depend on it, so always check dependencies first.
Search acceleration creates a summary index for faster repeated runs on time-bounded searches.
These come up on the exam all the time. Here's how to tell them apart.
Saved Search
Stores only the query and settings
No visual formatting applied
Can be used as a base for alerts and dashboards
Report
Stores the query plus chart/table formatting
Includes visualisation options like colours and labels
Depends on a saved search; if saved search is deleted, report breaks
Scheduled Saved Search
Runs at set intervals (e.g., every hour)
Uses historical data in the chosen time range
Common for daily reports and batch alerts
Real-Time Saved Search
Continuously monitors new data as it arrives
Requires real-time search mode
Common for live dashboards and immediate alerting
Private Saved Search
Visible only to the creator
Cannot be seen or run by other users
Default state for all new saved searches
Shared Saved Search
Visible to other roles or the entire app
Requires explicit permission changes
Essential for team collaboration and reporting
Mistake
A saved search stores the result data from the first time you ran it, so you can view it again later.
Correct
A saved search stores only the query text and settings. Every time you run it, Splunk re-queries the index and fetches fresh data.
This misconception comes from comparing it to bookmarking a webpage, which captures the page content at that moment. In Splunk, the index changes constantly, so results must be regenerated.
Mistake
If I add a chart to a saved search, it becomes a dashboard.
Correct
Adding a chart to a saved search creates a report. A dashboard is a separate object that can contain multiple report panels.
The visual similarity between a report panel and a dashboard panel leads beginners to think they are the same thing. The exam tests this distinction carefully.
Mistake
Only administrators can create and manage saved searches.
Correct
Any user with permission to search can create a saved search, but managing (editing, deleting, sharing) someone else's search requires appropriate role-based access.
New users often assume all powerful features are restricted. In reality, Splunk is designed to empower power users, not just admins.
Mistake
If I schedule a saved search, it will always run exactly at the scheduled time regardless of system load.
Correct
Scheduled searches may be delayed if the Splunk instance is under heavy load or if there are many scheduled searches queued up.
People assume scheduling is as precise as a timer on a microwave. Splunk's scheduler uses a queue, and delays can happen, especially in distributed environments.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A saved search is just your query and its settings. A report is a saved search with visualisation added — like a chart or table. When you save as a report, Splunk creates both a saved search and a report object.
Yes, you can. By default, saved searches are private. To share, edit the permissions and set them to 'App' level or grant read access to specific roles. Only users with permissions can see and run it.
The report or alert will break and stop working. Splunk will show an error because the underlying query no longer exists. Always check for dependencies before deleting.
Open the saved search, click 'Schedule', set the interval to 'Daily' and the start time to 08:00. You can also use cron expressions for more complex schedules.
Acceleration creates a summary index that pre-computes results for common time ranges. This makes repeated runs of the same search much faster, especially on large datasets.
Yes, you can edit the search string, time range, permissions, and schedule at any time. Changes affect all reports and alerts that depend on that saved search.
You've finished Saved Searches Basics. Continue through the SPLK-1003 study guide to build a complete picture of the exam.
Done with this chapter?