topic Re: Where is XML in Splunk Search

Where is XML

motobeats — Tue, 09 Jul 2013 19:58:25 GMT

I have a view I want to edit for customization. The URL is below, but I cannot find the xml on the server.

localhost:8001/en-US/manager/search/data/ui/views/Test_1

I thought it would be here:

$SPLUNK_HOME/etc/apps/<app_name>/local/data/ui/views/

But search does not seem to have a local folder.

Ayn — Tue, 09 Jul 2013 20:03:39 GMT

Did you check default?

motobeats — Tue, 09 Jul 2013 20:17:03 GMT

Under $SPLUNK_HOME/etc/apps/search I only have a bin folder and no files.

lguinn2 — Tue, 09 Jul 2013 20:29:23 GMT

If this is not a shared view, it will probably be under

$SPLUNK_HOME/etc/users/<username>/search/local/data/ui/views/Test_1

linu1988 — Tue, 09 Jul 2013 20:40:17 GMT

Yes correct, i was about to suggest that!

motobeats — Mon, 28 Sep 2020 14:17:26 GMT

No search folder for me on that path:

[root@wf-1 admin]# pwd
/opt/splunk/etc/users/admin
[root@wf-1 admin]# ls
user-prefs

[root@wf-1 user-prefs]# pwd
/opt/splunk/etc/users/admin/user-prefs
[root@wf-1 user-prefs]# ls
local metadata

Tried a find at $SPLUNK_HOME and come up empty for Test_1

lguinn2 — Wed, 10 Jul 2013 02:17:39 GMT

Ah, how did you create this? Test_1 might be the name of the dashboard, not the name of the file...

motobeats — Wed, 10 Jul 2013 14:01:17 GMT

Ok, I found the issue. I was looking in the wrong $SPLUNK_HOME (prior installation). User error.

/splunk/etc/users/admin/search/local/data/ui/views

Thanks lguinn for the right path.