Dashboards & Visualizations

unix app with local data folder

adamw
Communicator

So we have the default download of the Unix app, and we moved all of our unix stuff into the unix_os index, instead of the os index as suggested by the app.

I've already modified the saved searches in the app to reflect this change, but a lot of the dashboard views are still not working. I noticed they are defined in the default/data/ui/ folder.

Can I copy this data folder to the local/data/ folder and have it override the default ones. I know this works for configs, but what about dashboard views and other UI changes?

Thanks, --adam

0 Karma

Simeon
Splunk Employee
Splunk Employee

Copying UI views into the local location of an app should force those views to take precedence over the default settings.

gkanapathy
Splunk Employee
Splunk Employee

You should not have had to do this. I have overridden views by copying and modifying them in local. The default folder will be restored after applying a service release.

0 Karma

adamw
Communicator

Thats what I assumed as well, but it didn't seem to work after a splunk restart. I had to overwrite the default folder's directory for my changes to take effect.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...