Hi,
I'm trying to edit the Distributed Management Console (DMC) alert on total license usage, but when I change the number in Splunk Web, and click submit, it just sits there. I tried disabling it and modifying it, and that didn't work either. I also tried editing the dmc_alerts.conf, but when I restarted the Splunk server, it gave me a warning about the default file being changed. So, I put the dmc_alerts.conf in ../local and modified it and restarted Splunk, and it gave me the same warning and the value still isn't changed.
Anyone?
@a212830 - Did the answer provided by woodcock help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!
Find the savesearches.conf
file on DMC and your alert in it. Go up 1 directory and verify or create a directory called local
. Copy savedsearches.conf
(to preserve permissions) into the local
directory`. Edit the copy and delete EVERYTHING except for the stanza header (inside square brackets) along with ONLY the line that you need to change. So your new file has 2 lines: a header and the changed line. Save and bounce Splunk.
What version of Splunk are you running?
How about some screenshot love? I'm not 100% about the symptoms you're seeing.