I'm trying to edit the Distributed Management Console (DMC) alert on total license usage, but when I change the number in Splunk Web, and click submit, it just sits there. I tried disabling it and modifying it, and that didn't work either. I also tried editing the dmcalerts.conf, but when I restarted the Splunk server, it gave me a warning about the default file being changed. So, I put the dmcalerts.conf in ../local and modified it and restarted Splunk, and it gave me the same warning and the value still isn't changed.
savesearches.conf file on DMC and your alert in it. Go up 1 directory and verify or create a directory called
savedsearches.conf (to preserve permissions) into the
local directory`. Edit the copy and delete EVERYTHING except for the stanza header (inside square brackets) along with ONLY the line that you need to change. So your new file has 2 lines: a header and the changed line. Save and bounce Splunk.
@a212830 - Did the answer provided by woodcock help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!