Alerting

Why am I unable to edit the Distributed Management Console (DMC) alert on license usage?

a212830
Champion

Hi,

I'm trying to edit the Distributed Management Console (DMC) alert on total license usage, but when I change the number in Splunk Web, and click submit, it just sits there. I tried disabling it and modifying it, and that didn't work either. I also tried editing the dmc_alerts.conf, but when I restarted the Splunk server, it gave me a warning about the default file being changed. So, I put the dmc_alerts.conf in ../local and modified it and restarted Splunk, and it gave me the same warning and the value still isn't changed.

Anyone?

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@a212830 - Did the answer provided by woodcock help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

woodcock
Esteemed Legend

Find the savesearches.conf file on DMC and your alert in it. Go up 1 directory and verify or create a directory called local. Copy savedsearches.conf (to preserve permissions) into the local directory`. Edit the copy and delete EVERYTHING except for the stanza header (inside square brackets) along with ONLY the line that you need to change. So your new file has 2 lines: a header and the changed line. Save and bounce Splunk.

0 Karma

adonio
Ultra Champion

What version of Splunk are you running?

0 Karma

sloshburch
Splunk Employee
Splunk Employee

How about some screenshot love? I'm not 100% about the symptoms you're seeing.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...