Create Saved Search
create_saved_searchCreate persistent Splunk saved searches with optional scheduling and sharing. Persist SPL queries, set cron schedules, and control visibility for automation.
Instructions
Create a saved search (report/automation) with optional scheduling and sharing. Use this to persist useful SPL queries and optionally schedule them via cron.\n\nOutputs: creation status and the applied configuration.\nSecurity: visibility and execution are constrained by permissions and chosen sharing level.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | ||
| name | Yes | ||
| search | Yes | ||
| sharing | No | user | |
| is_visible | No | ||
| description | No | ||
| latest_time | No | ||
| is_scheduled | No | ||
| cron_schedule | No | ||
| earliest_time | No |