Why am I unable to edit the Distributed Management Console (DMC) alert on license usage?

[a212830]

Hi,

I'm trying to edit the Distributed Management Console (DMC) alert on total license usage, but when I change the number in Splunk Web, and click submit, it just sits there. I tried disabling it and modifying it, and that didn't work either. I also tried editing the dmc_alerts.conf, but when I restarted the Splunk server, it gave me a warning about the default file being changed. So, I put the dmc_alerts.conf in ../local and modified it and restarted Splunk, and it gave me the same warning and the value still isn't changed.

Anyone?

[aaraneta_splunk]

@a212830 - Did the answer provided by woodcock help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

[woodcock]

Find the savesearches.conf file on DMC and your alert in it. Go up 1 directory and verify or create a directory called local. Copy savedsearches.conf (to preserve permissions) into the local directory`. Edit the copy and delete EVERYTHING except for the stanza header (inside square brackets) along with ONLY the line that you need to change. So your new file has 2 lines: a header and the changed line. Save and bounce Splunk.

[adonio]

What version of Splunk are you running?

[sloshburch]

How about some screenshot love? I'm not 100% about the symptoms you're seeing.