S.O.S "Server to query" dropdown option to search all instances

[bleung93]

Hello, I have version 5.0.3, build 163460 of Splunk with S.O.S. app version 3.0.1

When entering the "UI and User Search Activity" dashboard, the drop-down menu for "Server to query:" displays all the servers that Splunk is installed on. How would I modify the dashboard to display all the servers at once in the results?

I do not want to extract the search query and enter host="*", I want the drop-down menu to have an option for all servers to query. Please advise.

[martin_mueller]

That's fairly simple to do. Go to Manager -> UI -> Views -> search_user_activity and scroll down about 1.5 screens. You'll find a Pulldown module that has an empty staticFieldsToDisplay param at the end. Change that to this:

<param name="staticFieldsToDisplay">
  <list>
    <param name="value">*</param>
  </list>
</param>

Note, doing that creates a copy of the view in etc/apps/sos/local/..., so any SoS updates to that view won't automatically take effect.