https://community.splunk.com/t5/Alerting/Why-am-I-unable-to-edit-the-Distributed-Management-Console-DMC/m-p/319867#M5710 <P>Find the <CODE>savesearches.conf</CODE> file on DMC and your alert in it. Go up 1 directory and verify or create a directory called <CODE>local</CODE>. Copy <CODE>savedsearches.conf</CODE> (to preserve permissions) into the <CODE>local</CODE> directory`. Edit the copy and delete EVERYTHING except for the stanza header (inside square brackets) along with ONLY the line that you need to change. So your new file has 2 lines: a header and the changed line. Save and bounce Splunk.</P> Tue, 28 Feb 2017 20:18:03 GMT woodcock 2017-02-28T20:18:03Z https://community.splunk.com/t5/Alerting/Why-am-I-unable-to-edit-the-Distributed-Management-Console-DMC/m-p/319864#M5707 <P>Hi,</P> <P>I'm trying to edit the Distributed Management Console (DMC) alert on total license usage, but when I change the number in Splunk Web, and click submit, it just sits there. I tried disabling it and modifying it, and that didn't work either. I also tried editing the dmc_alerts.conf, but when I restarted the Splunk server, it gave me a warning about the default file being changed. So, I put the dmc_alerts.conf in ../local and modified it and restarted Splunk, and it gave me the same warning and the value still isn't changed.</P> <P>Anyone? </P> Tue, 29 Sep 2020 12:59:33 GMT https://community.splunk.com/t5/Alerting/Why-am-I-unable-to-edit-the-Distributed-Management-Console-DMC/m-p/319864#M5707 a212830 2020-09-29T12:59:33Z https://community.splunk.com/t5/Alerting/Why-am-I-unable-to-edit-the-Distributed-Management-Console-DMC/m-p/319865#M5708 <P>How about some screenshot love? I'm not 100% about the symptoms you're seeing.</P> Tue, 28 Feb 2017 13:56:13 GMT https://community.splunk.com/t5/Alerting/Why-am-I-unable-to-edit-the-Distributed-Management-Console-DMC/m-p/319865#M5708 sloshburch 2017-02-28T13:56:13Z https://community.splunk.com/t5/Alerting/Why-am-I-unable-to-edit-the-Distributed-Management-Console-DMC/m-p/319866#M5709 <P>What version of Splunk are you running?</P> Tue, 28 Feb 2017 18:53:49 GMT https://community.splunk.com/t5/Alerting/Why-am-I-unable-to-edit-the-Distributed-Management-Console-DMC/m-p/319866#M5709 adonio 2017-02-28T18:53:49Z https://community.splunk.com/t5/Alerting/Why-am-I-unable-to-edit-the-Distributed-Management-Console-DMC/m-p/319867#M5710 <P>Find the <CODE>savesearches.conf</CODE> file on DMC and your alert in it. Go up 1 directory and verify or create a directory called <CODE>local</CODE>. Copy <CODE>savedsearches.conf</CODE> (to preserve permissions) into the <CODE>local</CODE> directory`. Edit the copy and delete EVERYTHING except for the stanza header (inside square brackets) along with ONLY the line that you need to change. So your new file has 2 lines: a header and the changed line. Save and bounce Splunk.</P> Tue, 28 Feb 2017 20:18:03 GMT https://community.splunk.com/t5/Alerting/Why-am-I-unable-to-edit-the-Distributed-Management-Console-DMC/m-p/319867#M5710 woodcock 2017-02-28T20:18:03Z https://community.splunk.com/t5/Alerting/Why-am-I-unable-to-edit-the-Distributed-Management-Console-DMC/m-p/319868#M5711 <P>@a212830 - Did the answer provided by woodcock help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!</P> Fri, 21 Apr 2017 17:26:58 GMT https://community.splunk.com/t5/Alerting/Why-am-I-unable-to-edit-the-Distributed-Management-Console-DMC/m-p/319868#M5711 aaraneta_splunk 2017-04-21T17:26:58Z