So we have the default download of the Unix app, and we moved all of our unix stuff into the unix_os index, instead of the os index as suggested by the app.
I've already modified the saved searches in the app to reflect this change, but a lot of the dashboard views are still not working. I noticed they are defined in the default/data/ui/ folder.
Can I copy this data folder to the local/data/ folder and have it override the default ones. I know this works for configs, but what about dashboard views and other UI changes?
Thanks, --adam
Copying UI views into the local location of an app should force those views to take precedence over the default settings.
You should not have had to do this. I have overridden views by copying and modifying them in local. The default folder will be restored after applying a service release.
Thats what I assumed as well, but it didn't seem to work after a splunk restart. I had to overwrite the default folder's directory for my changes to take effect.