Edit a view from and existing app

[strueblood]

I've loaded the Cisco Security App in splunk. I like some of the reports that they provide under views but I need to customize them to our needs. They don't quite extend to the time that we'd like.\

Under the actions menu the edit optioon is not available like it is with a typical view and dashboard.

How can I edit these?

I've already been down the road of app permission, dashboard permissions.

[sideview]

The Edit links in the actions menu are only available for views written in Splunk's 'simplified XML'. The simplified XML is just a sort of macro or shorthand way of writing a view in the underlying 'advanced XML', and most or quite possibly all of the Cisco app's views are written in the advanced XML.

However you can go to Manager, User Interface, Views, and edit any view you see there.

When you save that edited version, Splunk will create a copy of that view at

<splunkHome>/etc/apps/<appName>/local/data/ui/views

and the local vs system distinction should call to mind splunk's layered system for conf files, because that's how it works -- the version of the view in local will override the version in system.

I do not recommend editing the version in the system folder because if and when you upgrade the cisco app to a newer version, your changes would be clobbered.

[Genti]

i have not played with the Cisco Security App, but i am assuming this app has a directory (similar to the search app) where you can go and modify what you would like.
/splunk/etc/apps/search/default/data/ui/views - here you can modify the views for the search app, try locating a similar directory for the Cisco Security App and try modifying the xml files in there.

Note, i would recommend making a backup to the directory before you commit any changes.