Manage Existing Saved Searches

Security Requirements and Controls

  • Delete saved queries permission

  • Update saved queries permission

The Search interface organizes your queries in three tabs under the Searches button: recent, saved and favorite queries.

Screenshot showing the available tabs and functionality for managing saved and recent searches

Figure 137. Saved Searches


  • My recents tab. Lists recently run queries divided by date. You may either:

    • Click on a recent query in the list to get a preview of the query in read-only mode, from which you can:

      • click Run to make it running again

      • save it as is to make it a new saved search (see Create a Saved Search).

      • load it to the query editor side panel to make changes before running your query again.

    • Hover over a recent query to:

      • run it again without any preview by clicking Run

      • select Save from the three-dot menu to save it as is

      • select Load to editor from the three-dot menu to preview or edit the query in the side panel before running it again

      Figure 138. Playing with Recent Queries


  • Saved searches tab. Shows all of your saved queries. This list also displays the labels and the package name each query comes from.

    The sorting of the Saved Searches list is organized by Package, Favourite status (user selected), and the name. The status of each saved search (whether it has been selected as a favorite) is not shown in the display.

    You may either click or hover over a saved query in the list to access several functionalities:

    • Add as function adds the query as a function ($"MySavedQuery"()) to the pipeline at the cursor position in the side panel. For more information about using saved queries as functions, see Saved Searches (User Functions).

      If using crossview assets, the full reference path will be included in the query when it is saved as a function. For more information, see Resolving Resources to a Different Named View or Repository.

    • Load to editor loads the query to the query editor side panel without running the query.

    • Run runs the query.

    • Edit brings the query back to the Search page in Editing saved search mode.

    • Add to favorites Stars/unstars the saved query. Starring the saved query will make it appear in the Favorites tab.

    • Export as YAML exports the saved query as a file in yaml format.

    • Duplicate allows for copying a saved query to the same repository or to a different repository/view.

    • Asset sharing allows for sharing the saved search with another user, see Grant Permissions for Saved Queries for more information.

    • Delete deletes the saved query.

    Hint

    Clicking instead of hovering a query allows you to preview the query in read-only mode and copy the query string, before taking any of the above actions.

    Figure 139. Playing with Saved Queries


  • Favorites tab. Lists the saved searches that have been marked as favorite. The functionalities available for saved searches also apply for favorites searches.