# How to use a saved search as a data source for timelion anlysis

**URL:** <https://discuss.elastic.co/t/how-to-use-a-saved-search-as-a-data-source-for-timelion-anlysis/144917>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [August 17, 2018, 2:04pm UTC](https://discuss.elastic.co/t/how-to-use-a-saved-search-as-a-data-source-for-timelion-anlysis/144917 "2018-08-17T14:04:53Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![kolli\_dilip](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kolli_dilip/32/33821_2.png) [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)\
**Post date:** [August 17, 2018, 2:04pm UTC](https://discuss.elastic.co/t/how-to-use-a-saved-search-as-a-data-source-for-timelion-anlysis/144917/1 "2018-08-17T14:04:53Z")

</div>

Hi

i have a set of indexed data with the index format abcd-dd-mm-yy

i have as set of searches made on the index and saved them based on my productname.

while checking out the timelion i am able to extract the success scenario of the index for overall products, but can i add my searches also to the below query

.es(index=abcd-_, timefield='@timestamp', metric='sum:Success').label('current week'),.es(offset=-1w,index=abcd-_, timefield='@timestamp', metric='sum:Success').label('last week')

so can you please suggest how to add the saved search or the specific field (productname) into the query so that the data for the same can be analyzed

Many thanks in advance

---

<div class="post-metadata">

**Author:** ![timroes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timroes/32/19712_2.png) [@timroes](https://discuss.elastic.co/u/timroes)\
**Post date:** [August 17, 2018, 2:07pm UTC](https://discuss.elastic.co/t/how-to-use-a-saved-search-as-a-data-source-for-timelion-anlysis/144917/2 "2018-08-17T14:07:57Z")

</div>

Hi,

using saved searches in timelion is currently not possible. The feature request to add this is [#16826](https://github.com/elastic/kibana/issues/16826).

Cheers,  
Tim

---

<div class="post-metadata">

**Author:** ![kolli\_dilip](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kolli_dilip/32/33821_2.png) [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)\
**Post date:** [August 17, 2018, 2:08pm UTC](https://discuss.elastic.co/t/how-to-use-a-saved-search-as-a-data-source-for-timelion-anlysis/144917/3 "2018-08-17T14:08:57Z")

</div>

oh is there any way that i can search with in the query after index

---

<div class="post-metadata">

**Author:** ![timroes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timroes/32/19712_2.png) [@timroes](https://discuss.elastic.co/u/timroes)\
**Post date:** [August 17, 2018, 2:12pm UTC](https://discuss.elastic.co/t/how-to-use-a-saved-search-as-a-data-source-for-timelion-anlysis/144917/4 "2018-08-17T14:12:22Z")

</div>

Yes you can use the `q` (query) parameter to the `.es` function to specify a lucene query:

```auto
.es(q='county:NL', index=abcd-, ...)

```

---

<div class="post-metadata">

**Author:** ![kolli\_dilip](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kolli_dilip/32/33821_2.png) [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)\
**Post date:** [August 17, 2018, 2:13pm UTC](https://discuss.elastic.co/t/how-to-use-a-saved-search-as-a-data-source-for-timelion-anlysis/144917/5 "2018-08-17T14:13:48Z")

</div>

fine will try out and get back @timroes thank you

---

<div class="post-metadata">

**Author:** ![kolli\_dilip](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kolli_dilip/32/33821_2.png) [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)\
**Post date:** [August 21, 2018, 12:02pm UTC](https://discuss.elastic.co/t/how-to-use-a-saved-search-as-a-data-source-for-timelion-anlysis/144917/6 "2018-08-21T12:02:28Z")

</div>

thanks i tried the 'q' for my search 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 18, 2018, 12:02pm UTC](https://discuss.elastic.co/t/how-to-use-a-saved-search-as-a-data-source-for-timelion-anlysis/144917/7 "2018-09-18T12:02:50Z")

</div>

Closed on September 18, 2018, 12:02pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.