Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: Edit Form/Dashboard XML manually , Splunk does...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Edit Form/Dashboard XML manually , Splunk does not refresh unless XML edited through GUI
It seems I can't edit dashboard and form XML's using my own editor. Upon saving, Splunk does not refresh (probably because it reads from DB cache instead of file?), how can I force it to read the file every time it changes because I'd like to use my own IDE instead of the splunk xml editor.
Thanks,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Restarting with
http://debug/refresh
worked when editing files outside of Splunk Enterprise 8.0.6.
If I edit the file directly in (\default\data\ui\views\) and then click on the App in the upper left corner of the screen under 'Apps', the display content for the modified file is not updated.
Confirming what @DanMurad posted.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, I tried both the reload all objects and just views ... the views one doesn't work, the all objects one will sometimes work.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you try the reload endpoint as listed below? After doing this reload, we need to refresh the dashboard page.
http://
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm having this exact same problem with Version 6.1.1 ... Any other ideas here, I've tried everything listed but it will not refresh custom dashboards. Doing a ?showsource=1 shows the out of date code.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can reload these from disk using the following endpoint(s).
To reload all objects:
http://
To reload views only:
http://
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
All views in the app are refreshed when you access the app's start URL ( .../apps/yourapp ). You can just click the app logo at the top left corner in your app in splunkweb to achieve the same thing.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That is exactly what I mean. The methods I describe work perfectly for refreshing on the Dplunk instances I've used.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is incorrect. It does not refresh. I hope you understand when I say edit the xml I mean editing the file /opt/splunk/etc/apps/
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It would have been tolerable if Save button didn't exit everytime making you find and click the view name again to edit it.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
