Deployment Architecture

How to Get Edits to "Take"?


I've used the information previously posted to manually update some XML files in an application and then to restart splunk, and the edits I've made in the files still do not appear. I've also exited the session and the browser, and no dice.

If I edit an XML file manually, how do I get it to "take"? What else can I do?


Tags (2)
0 Karma

Esteemed Legend

Where is your "previously posted" link? What have you edited? Where did you put the edited files? Because you have not provided any details, I will have to guess. Assuming you have updated views inside an app, if you placed them in default, you need to make sure an old copy of the same file is not inside local because then it will have precedence and the other one will be ignored. You also need to make sure that this file is copied to the Search Head (or deployed to it from your DS). You should not need to restart Splunk for changes to take effect (but you will have to refresh your browser if you are on that dashboard).

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...