Hello, I have version 5.0.3, build 163460 of Splunk with S.O.S. app version 3.0.1
When entering the "UI and User Search Activity" dashboard, the drop-down menu for "Server to query:" displays all the servers that Splunk is installed on. How would I modify the dashboard to display all the servers at once in the results?
I do not want to extract the search query and enter host="*", I want the drop-down menu to have an option for all servers to query. Please advise.
That's fairly simple to do. Go to Manager -> UI -> Views -> search_user_activity and scroll down about 1.5 screens. You'll find a Pulldown module that has an empty staticFieldsToDisplay
param at the end. Change that to this:
<param name="staticFieldsToDisplay">
<list>
<param name="value">*</param>
</list>
</param>
Note, doing that creates a copy of the view in etc/apps/sos/local/..., so any SoS updates to that view won't automatically take effect.