I have a savedsearch defined in my savedsearches.conf like the following> [my_saved_search]> search = "index=........"> earliest = "-30d@d"> .......
Hence the savedsearch view and the mysplunk.com/myapp/reports/ shows this saved search as "my_saved_search".
Is there an attribute that I can set to override the name of the saved search (because I don't want the display to have underscore). As mentioned in the savedsearches.conf I tried setting
> displayview = My Saved Search
but doesn't seem to work.
Any help is appreciated.
↧