# Saved Searches Basics

> Chapter 9 of the Courseiva SPLUNK-CORE-CERTIFIED-POWER-USER curriculum — https://courseiva.com/learn/splunk-core-certified-power-user/saved-searches-basics

**Official objective:** 3.2 — Create and manage saved searches and use them for reporting.

## Introduction

Saved Searches: the feature that turns a one-time search into a reusable tool you can run on demand or on a schedule. Without saved searches, you would retype the same Splunk query every time you needed a weekly report or a security alert. For the SPLK-1003 exam, knowing how to create, manage, and use saved searches is essential because it moves you from ad-hoc searching to automated reporting — a core skill for a Power User.

## The Office Manager's Filing System Analogy

Meet Priya, the office manager at a busy dental practice. Every morning, she runs the same report: a list of patients who haven't visited in over a year, sorted by their last appointment date. Instead of flipping through paper files each time, she saves the exact search steps in her notebook. That notebook is her "saved search."

Priya's saved search has a name — "Overdue Patients 12 Months" — and she can run it with one click. She can also schedule it: every Monday at 8 AM, the report prints automatically. If she wants to see only patients in a specific postal code, she can open her notebook, tweak the filter, and run a modified version without starting from scratch.

One day, Priya shares her notebook with a colleague. The colleague sees exactly which criteria Priya uses and can run the same report independently. This saves hours of repetitive work and ensures consistency. Just like in Splunk, a saved search captures the query logic, not just the results — so anyone with permission can reproduce it exactly, anytime, without needing to remember the steps.

## Core explanation

In Splunk, a saved search is exactly what it sounds like: a search query that you save so you can run it again later without retyping it. When you save a search, Splunk stores the search string, the time range, and any settings you applied (like acceleration or permissions). This is different from just bookmarking a results page — a saved search re-executes the query, so you always get fresh data.

Why does this matter? In a real IT environment, people run the same searches over and over. For example, a security analyst might check every morning for failed login attempts in the last 24 hours. Instead of typing `index=main sourcetype=linux_secure "failed password"` and picking a time range manually each time, they save that search once. Then every morning, they open it, click run, and get the latest results in seconds.

Saved searches are the foundation of several important Splunk features:

- Reports: When you save a search as a report, you can visualise the results as a chart or table. Saved searches are the raw query; reports add formatting and display options.
- Alerts: A saved search can be converted into an alert that triggers an action (like sending an email) when results match certain conditions.
- Dashboards: Dashboard panels are often powered by saved searches, so dashboard content updates automatically as new data comes in.

To create a saved search, you first run a search in the Search & Reporting app. Once you're happy with the results, click the "Save As" button and choose "Search". Give it a name — something descriptive like "Failed Logins - Last 24h" — and optionally add a description. You can also set a time range picker so that when you run the search later, it applies the same range (e.g., "Last 24 hours") automatically.

After saving, you manage your saved searches from the "Searches, Reports, and Alerts" page under Settings. Here, you can edit the search string, change permissions, schedule the search to run automatically, and even accelerate the search for faster performance on large datasets. Acceleration creates a summary index that pre-computes the results for common time buckets, making repeated runs much faster.

One key concept is the difference between a saved search and a report. A saved search is exactly the query. A report is a saved search that has been formatted — it chooses what to display (table, chart, statistics) and how to display it. When you save a search as a report, Splunk actually creates both a saved search and a report object linked to it.

Permissions matter: you can share saved searches with specific roles, users, or everyone. By default, only you and users with admin roles can see your saved search. For team projects, you should set permissions to "App" level so all team members with access to the app can use it.

Another powerful feature is scheduled saved searches. Instead of running a search manually, you can set a schedule — for example, every hour, daily at midnight, or every Monday at 9 AM. The scheduled search runs in the background, and you can configure it to trigger an alert or update a dashboard. This is how real-time monitoring works in Splunk: a scheduled saved search continuously checks for conditions and notifies you when something interesting happens.

Finally, when you delete a saved search, you remove only the query definition — any reports or alerts that depend on it will break and need to be reassigned. So always check dependencies before deleting.

## Real-world context

Imagine you work as a junior IT analyst at a mid-sized e-commerce company. The company uses Splunk to monitor its web servers, application logs, and security events. Every Monday morning, your manager asks for a report: "How many 500 Internal Server Errors did we get last week, broken down by server?"

Without saved searches, you would log into Splunk, type `index=web sourcetype=access_combined status=500`, set the time range to "Last 7 days", click search, wait for results, then manually copy the data into a spreadsheet and create a chart. You do this every week. It takes 15 minutes each time. One Friday, you're off sick, and Monday the report doesn't get done. That's a problem.

With saved searches, the process looks different. You create a saved search called "500 Errors - Weekly by Server" with this query: `index=web sourcetype=access_combined status=500 | stats count by host`. You save it with a time range of "Last 7 days" and set permissions so everyone in your team can use it.

Now, here's what happens step by step:

- Monday morning: you open the saved search, click "Run", and get the results in under a minute.
- You click "Save As Report" and choose a bar chart format. The report is now available on your team's dashboard.
- You schedule the report to run automatically every Monday at 7 AM. Now, even if you're on holiday, the report updates itself.
- Your manager can access the report directly from the dashboard without asking you.
- If you need to modify the search later — say, you want to filter out a specific test server — you edit the saved search once, and all reports and dashboards using it update automatically.

Beyond reporting, you also use saved searches for ad-hoc troubleshooting. One afternoon, a customer reports a slow checkout process. You suspect a specific API endpoint is failing. You run a quick search, find the issue, and save it as "Checkout API Errors" so you can monitor it again tomorrow.

The real value is consistency: every time someone runs the saved search, they get results based on the same logic. There's no variation from one person to another, and no chance of mis-typing the query. This is critical for compliance and auditing, especially in regulated industries.

You also learn to use the "Schedule" feature for proactive monitoring. For example, a saved search that counts failed SSH logins every hour. If the count exceeds a threshold, an alert triggers an email to the security team. This saved search is the heart of your company's intrusion detection setup.

## Exam focus

The SPLK-1003 exam tests saved searches mainly in the context of creating and using them for reporting. You won't need to memorise every button, but you must understand the core concepts and common decision points.

Here are the specific topics the exam likes to quiz:

- The difference between a saved search and a report: A saved search is the query. A report is the query plus formatting/visualisation. The exam often presents a scenario and asks whether you should save as a search or as a report. The answer is: if you only need the raw data, save as search. If you need a chart or table for a dashboard, save as report.
- How to share a saved search: The exam tests your knowledge of permissions. You'll see a question like, "A team member cannot see your saved search. What should you do?" The answer usually involves setting permissions to "App" level or granting read access to the appropriate role.
- Scheduled searches: They ask about scheduling options — daily, hourly, cron expressions — and what happens if a scheduled search is disabled or deleted. Remember that disabling a scheduled search stops it from running, but the search definition remains.
- Acceleration: Questions about search acceleration and summary indexing. They test whether you know that acceleration makes repeated runs faster by pre-computing results, and that it works best on time-based searches.
- Traps to watch for:

- Trap: Confusing saved searches with dashboards. A dashboard is a collection of panels, each of which may use a saved search. The saved search is the underlying query, not the dashboard itself.
- Trap: Thinking that deleting a saved search deletes its results. It only deletes the query definition. Results are not stored by the saved search — they come from the index each time.
- Trap: Assuming all saved searches are visible to everyone by default. They are private unless shared.
- Trap: Mixing up the "Save As" vs "Save" buttons. "Save As" creates a new saved search. "Save" saves changes to an existing one.

Key definitions to memorise:

- Saved search: A stored search query with a name, description, time range, and settings.
- Report: A saved search with visualisation options (chart type, label, etc.).
- Alert: A saved search that triggers an action based on a condition.
- Acceleration: A feature that pre-computes results for faster execution.
- Schedule: A time-based trigger that runs a saved search automatically.

Practice questions will often give you a search string and ask you to identify which part is the search itself versus the time range or the reporting command. Another common trap: they present a scenario where a user wants to reuse a search but change the time range each time. The correct answer is to set the time range to "Real-time" or use a relative time range (like "Last 60 minutes") so the user can override it manually.

Finally, expect at least one question about the order of operations when running a saved search: Splunk first checks permissions, then runs the query against the index, then applies any post-processing (like stats or timechart commands), and finally returns the results. Understanding that order helps you troubleshoot why a saved search might return unexpected data.

## Step by step

1. **Run your search** — Open Splunk Search & Reporting, type your query into the search bar, select the appropriate time range, and run it. Verify the results look correct before saving.
2. **Click 'Save As' and choose 'Search'** — This opens the save dialog. You must decide whether to save as a search (query only) or a report (query plus visualisation). For the exam, remember that reports are an extension of saved searches.
3. **Name and describe your saved search** — Give it a descriptive, unique name that reflects its purpose, e.g., 'Failed Logins - Last Hour'. Add a description for context. This matters when you have dozens of saved searches in an app.
4. **Configure time range and acceleration** — Set the time range input to 'Auto' or a specific relative range. Enable acceleration if the search runs on large datasets repeatedly. Acceleration pre-computes results for faster execution.
5. **Set permissions and schedule** — Share the search with your team by setting permissions to 'App' level. Optionally schedule the search to run automatically — for example, every 15 minutes for a monitoring alert.
6. **Save and verify** — Click 'Save'. Then find the saved search under 'Searches, Reports, and Alerts' in Settings. Run it again to confirm it works as expected. Check that the schedule, if set, triggers correctly.

## Comparisons

### Saved Search vs Report

**Saved Search:**
- Stores only the query and settings
- No visual formatting applied
- Can be used as a base for alerts and dashboards

**Report:**
- Stores the query plus chart/table formatting
- Includes visualisation options like colours and labels
- Depends on a saved search; if saved search is deleted, report breaks

### Scheduled Saved Search vs Real-Time Saved Search

**Scheduled Saved Search:**
- Runs at set intervals (e.g., every hour)
- Uses historical data in the chosen time range
- Common for daily reports and batch alerts

**Real-Time Saved Search:**
- Continuously monitors new data as it arrives
- Requires real-time search mode
- Common for live dashboards and immediate alerting

### Private Saved Search vs Shared Saved Search

**Private Saved Search:**
- Visible only to the creator
- Cannot be seen or run by other users
- Default state for all new saved searches

**Shared Saved Search:**
- Visible to other roles or the entire app
- Requires explicit permission changes
- Essential for team collaboration and reporting

## Diagram

_Flowchart showing how a saved search is the central object from which reports, alerts, and dashboard panels are created._

```mermaid
flowchart TD
    A[Run a Search] --> B{Save As?}
    B --> C[Saved Search]
    C --> D[Report]
    C --> E[Alert]
    C --> F[Dashboard Panel]
    D --> G[Visualised Report]
    E --> H[Trigger Action]
    E --> I[Schedule]
    C --> J[Share & Set Permissions]
    J --> K[Team or App Access]
```

## Common misconceptions

- **Misconception:** A saved search stores the result data from the first time you ran it, so you can view it again later. **Reality:** A saved search stores only the query text and settings. Every time you run it, Splunk re-queries the index and fetches fresh data. (This misconception comes from comparing it to bookmarking a webpage, which captures the page content at that moment. In Splunk, the index changes constantly, so results must be regenerated.)
- **Misconception:** If I add a chart to a saved search, it becomes a dashboard. **Reality:** Adding a chart to a saved search creates a report. A dashboard is a separate object that can contain multiple report panels. (The visual similarity between a report panel and a dashboard panel leads beginners to think they are the same thing. The exam tests this distinction carefully.)
- **Misconception:** Only administrators can create and manage saved searches. **Reality:** Any user with permission to search can create a saved search, but managing (editing, deleting, sharing) someone else's search requires appropriate role-based access. (New users often assume all powerful features are restricted. In reality, Splunk is designed to empower power users, not just admins.)
- **Misconception:** If I schedule a saved search, it will always run exactly at the scheduled time regardless of system load. **Reality:** Scheduled searches may be delayed if the Splunk instance is under heavy load or if there are many scheduled searches queued up. (People assume scheduling is as precise as a timer on a microwave. Splunk's scheduler uses a queue, and delays can happen, especially in distributed environments.)

## Key takeaways

- A saved search stores the query and settings, not the data — results are always fresh from the index.
- Reports are saved searches with visual formatting; a report depends on the underlying saved search.
- You can schedule a saved search to run automatically at a set interval for proactive monitoring.
- Permissions on saved searches default to private — you must explicitly share them with the team or app.
- Deleting a saved search breaks any alerts or reports that depend on it, so always check dependencies first.
- Search acceleration creates a summary index for faster repeated runs on time-bounded searches.

## FAQ

**What is the difference between a saved search and a report in Splunk?**

A saved search is just your query and its settings. A report is a saved search with visualisation added — like a chart or table. When you save as a report, Splunk creates both a saved search and a report object.

**Can I share a saved search with other users?**

Yes, you can. By default, saved searches are private. To share, edit the permissions and set them to 'App' level or grant read access to specific roles. Only users with permissions can see and run it.

**What happens if I delete a saved search that is used in a report or alert?**

The report or alert will break and stop working. Splunk will show an error because the underlying query no longer exists. Always check for dependencies before deleting.

**How do I schedule a saved search to run every day at 8 AM?**

Open the saved search, click 'Schedule', set the interval to 'Daily' and the start time to 08:00. You can also use cron expressions for more complex schedules.

**What does 'acceleration' mean for a saved search?**

Acceleration creates a summary index that pre-computes results for common time ranges. This makes repeated runs of the same search much faster, especially on large datasets.

**Can I modify a saved search after creating it?**

Yes, you can edit the search string, time range, permissions, and schedule at any time. Changes affect all reports and alerts that depend on that saved search.

## Check your understanding

1. **What is the main difference between a saved search and a report?**

   Answer: A saved search stores only the query and settings, while a report adds visual formatting (charts, tables) on top of the saved search.

2. **If you schedule a saved search to run every 15 minutes, what does Splunk do?**

   Answer: Splunk automatically re-executes the query against the index every 15 minutes, and you can configure it to trigger an alert if results meet a condition.

3. **True or false: Deleting a saved search also deletes its results from the index.**

   Answer: False. Deleting a saved search only removes the query definition. The data remains in the index and is unaffected.

4. **How do you allow other users in your team to see your saved search?**

   Answer: Edit the saved search's permissions and set visibility to 'App' level or grant 'Read' access to the appropriate role.

5. **What benefit does search acceleration provide for a saved search?**

   Answer: It pre-computes results into a summary index, making repeated runs much faster, especially for large datasets and time-based searches.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/splunk-core-certified-power-user/saved-searches-basics