Use an SPL2 module to work with multiple searches in a single browser tab.

1. From Splunk Home, select Search & Reporting in the Apps panel.
2. On the Search page, in the Search, transform, and analyze data using SPL2 area of the page, select Search in SPL2 module.
   The SPL2 module editor opens in a new browser tab.
3. In the Select data to search panel, select the index that you want to search and then select Apply.

   The SPL2 panel populates with an import statement and a search statement. The import statement makes your index available to searches in this module, and the search statement is what you use to actually search the data in your index.

   For example, if you select an index named main, then the following statements appear in the SPL2 panel:

   import main from ~indexes
   
   $search = search index=main

   Notice that the search statement starts with $search, which is the name of the search. Each search in the same module must be identified with a unique name.

4. (Optional) Change the name of the search by replacing $search in the SPL2 panel.

   Be aware that search name must meet these requirements, or else the search returns a syntax error:

   • Start with a dollar sign ( $ ).

   • Use a letter as the first character after the dollar sign ( $ ).

   • Contain only letters, numbers, or the underscore ( _ ) character.

   The following example shows the same search as the previous step after it has been renamed from $search to $my_search1:

   import main from ~indexes
   
   $my_search1 = search index=main

5. To run your search, do the following:
   1. Confirm that the time range picker is set to an appropriate time range for your search.
   2. Select the Run icon ().

   The search results panel displays the data returned by your search.

   Note: The search results panel displays a timeline that is based on an event field named _time. If you run a search that drops the _time field from your search results, then the timeline will not display as expected. For examples of searches that can prevent or cause this issue, see Drop event fields.
6. For each additional search that you want to add to your module, do the following:
   1. In the Outline panel, select the Add new statement icon ) and then select Statement.
      A new search statement is added to the SPL2 panel, and the Select data to search panel opens.
   2. In the Select data to search panel, select the index or dataset that you want to search and then select Apply.
      Note: You can branch a search by selecting it as the dataset for a subsequent search. Doing this allows you to progressively refine your searches by using the results from an initial base search as the starting dataset of your next search. See Branching SPL2 searches for more information.
      The SPL2 panel populates with the corresponding import statement and search statement.
   3. (Optional) Rename the search, if desired.
   4. To specify which search you want to run and see results from, do either of the following:
   • In the SPL2 panel, move your caret to the line that contains the search.

   • In the Outline panel, select the name of the search.

You now have an SPL2 module that contains one or more SPL2 searches.

The following image shows an example of an SPL2 module that contains 3 searches in addition to an import statement:

Save your SPL2 module, and configure permissions to keep the module private or share it with other Splunk platform users.

1. In the SPL2 module editor, select Save module.
2. In the Module name field, enter a name for identifying the module.
   A module ID is automatically generated based on the module name that you specify.
3. (Optional) To change the module ID, select Edit and then enter a different value in the Module ID field.
4. (Optional) In the Description field, enter a description for the module.
5. Choose whether to keep the module private so that only you can see its contents and run the searches it contains, or share the module so that other users of the Search & Reporting app can access it:

   Option	Description
   Keep the module private	Set the Namespaces toggle to Private. Select Save.
   Share the module	To save the module as a shared module, complete these steps: Set the Namespaces toggle to App. Select Save module and configure permissions. (Optional) In the Configure permissions dialog box, specify the level of module access allowed to each role in the Splunk platform instance. For more information, see SPL2 module permissions. Select Save.