Alerting
Highlighted

Why am I unable to edit the Distributed Management Console (DMC) alert on license usage?

Champion

Hi,

I'm trying to edit the Distributed Management Console (DMC) alert on total license usage, but when I change the number in Splunk Web, and click submit, it just sits there. I tried disabling it and modifying it, and that didn't work either. I also tried editing the dmcalerts.conf, but when I restarted the Splunk server, it gave me a warning about the default file being changed. So, I put the dmcalerts.conf in ../local and modified it and restarted Splunk, and it gave me the same warning and the value still isn't changed.

Anyone?

0 Karma
Highlighted

Re: Why am I unable to edit the Distributed Management Console (DMC) alert on license usage?

Ultra Champion

How about some screenshot love? I'm not 100% about the symptoms you're seeing.

0 Karma
Highlighted

Re: Why am I unable to edit the Distributed Management Console (DMC) alert on license usage?

SplunkTrust
SplunkTrust

What version of Splunk are you running?

0 Karma
Highlighted

Re: Why am I unable to edit the Distributed Management Console (DMC) alert on license usage?

Esteemed Legend

Find the savesearches.conf file on DMC and your alert in it. Go up 1 directory and verify or create a directory called local. Copy savedsearches.conf (to preserve permissions) into the local directory`. Edit the copy and delete EVERYTHING except for the stanza header (inside square brackets) along with ONLY the line that you need to change. So your new file has 2 lines: a header and the changed line. Save and bounce Splunk.

0 Karma
Highlighted

Re: Why am I unable to edit the Distributed Management Console (DMC) alert on license usage?

Splunk Employee
Splunk Employee

@a212830 - Did the answer provided by woodcock help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma