Deployment Architecture

Why are custom settings in ui-prefs.conf not being respected?

mdsnmss
SplunkTrust
SplunkTrust

I am trying to change the default time range when opening the search app. I have found several answers in other questions and have updated my ui-prefs.conf and deployed the shcluster bundle. This should initiate a restart if needed but initiated a rolling-restart in order to be sure. I ran "splunk cmd btool ui-prefs list --debug" to view the configurations from one of the search heads to confirm the settings. Here is a copy of the btool output:

[default]
countPerPage =
dispatch.earliest_time = @d
dispatch.latest_time = now
display.events.fields = ["host","source","sourcetype"]
display.events.list.drilldown = full
display.events.list.wrap = 1
display.events.maxLines = 5
display.events.raw.drilldown = full
display.events.rowNumbers = 0
display.events.table.drilldown = 1
display.events.table.wrap = 1
display.events.type = list
display.general.enablePreview = 1
display.page.home.showGettingStarted = 1
display.page.search.mode = smart
display.page.search.patterns.sensitivity = 0.8
display.page.search.searchHistoryTimeFilter = 0
display.page.search.showFields = 1
display.page.search.timeline.format = compact
display.page.search.timeline.scale = linear
display.prefs.aclFilter = none
display.prefs.appFilter = none
display.prefs.autoOpenSearchAssistant = 1
display.prefs.customSampleRatio = 1000
display.prefs.enableMetaData = 1
display.prefs.events.count = 20
display.prefs.fieldCoverage = .01
display.prefs.listMode = tiles
display.prefs.livetail = 0
display.prefs.searchContext = search
display.prefs.showDataSummary = 1
display.prefs.showSPL = 0
display.prefs.statistics.count = 20
display.prefs.timeline.height = 120px
display.prefs.timeline.minimalMode = 1
display.prefs.timeline.minimized = 0
display.statistics.drilldown = cell
display.statistics.rowNumbers = 0
display.statistics.wrap = 1
display.visualizations.chartHeight = 300
display.visualizations.charting.chart = column
display.visualizations.charting.chart.style = shiny
display.visualizations.charting.legend.labelStyle.overflowMode = ellipsisMiddle
display.visualizations.custom.type =
display.visualizations.type = charting
[job_manager]
countPerPage = 10
dispatch.earliest_time = @d
dispatch.latest_time = now
display.events.fields = ["host","source","sourcetype"]
display.events.list.drilldown = full
display.events.list.wrap = 1
display.events.maxLines = 5
display.events.raw.drilldown = full
display.events.rowNumbers = 0
display.events.table.drilldown = 1
display.events.table.wrap = 1
display.events.type = list
display.general.enablePreview = 1
display.page.home.showGettingStarted = 1
display.page.search.mode = smart
display.page.search.patterns.sensitivity = 0.8
display.page.search.searchHistoryTimeFilter = 0
display.page.search.showFields = 1
display.page.search.timeline.format = compact
display.page.search.timeline.scale = linear
display.prefs.aclFilter = none
display.prefs.appFilter = none
display.prefs.autoOpenSearchAssistant = 1
display.prefs.customSampleRatio = 1000
display.prefs.enableMetaData = 1
display.prefs.events.count = 20
display.prefs.fieldCoverage = .01
display.prefs.listMode = tiles
display.prefs.livetail = 0
display.prefs.searchContext = search
display.prefs.showDataSummary = 1
display.prefs.showSPL = 0
display.prefs.statistics.count = 20
display.prefs.timeline.height = 120px
display.prefs.timeline.minimalMode = 1
display.prefs.timeline.minimized = 0
display.statistics.drilldown = cell
display.statistics.rowNumbers = 0
display.statistics.wrap = 1
display.visualizations.chartHeight = 300
display.visualizations.charting.chart = column
display.visualizations.charting.chart.style = shiny
display.visualizations.charting.legend.labelStyle.overflowMode = ellipsisMiddle
display.visualizations.custom.type =
display.visualizations.type = charting
[search]
countPerPage =
dispatch.earliest_time = @d
dispatch.latest_time = now
display.events.fields = ["host","source","sourcetype"]
display.events.list.drilldown = full
display.events.list.wrap = 1
display.events.maxLines = 5
display.events.raw.drilldown = full
display.events.rowNumbers = 0
display.events.table.drilldown = 1
display.events.table.wrap = 1
display.events.type = list
display.general.enablePreview = 1
display.page.home.showGettingStarted = 1
display.page.search.mode = smart
display.page.search.patterns.sensitivity = 0.8
display.page.search.searchHistoryTimeFilter = 0
display.page.search.showFields = 1
display.page.search.timeline.format = compact
display.page.search.timeline.scale = linear
display.prefs.aclFilter = none
display.prefs.appFilter = none
display.prefs.autoOpenSearchAssistant = 1
display.prefs.customSampleRatio = 1000
display.prefs.enableMetaData = 1
display.prefs.events.count = 20
display.prefs.fieldCoverage = .01
display.prefs.listMode = tiles
display.prefs.livetail = 0
display.prefs.searchContext = search
display.prefs.showDataSummary = 1
display.prefs.showSPL = 0
display.prefs.statistics.count = 20
display.prefs.timeline.height = 120px
display.prefs.timeline.minimalMode = 1
display.prefs.timeline.minimized = 0
display.statistics.drilldown = cell
display.statistics.rowNumbers = 0
display.statistics.wrap = 1
display.visualizations.chartHeight = 300
display.visualizations.charting.chart = column
display.visualizations.charting.chart.style = shiny
display.visualizations.charting.legend.labelStyle.overflowMode = ellipsisMiddle
display.visualizations.custom.type =
display.visualizations.type = charting

The only settings that fall out of /etc/system/default/ui-prefs.conf are the dispatch.earliest_time and dispatch.latest_time settings. We are running a search head cluster that has been recently upgraded to 6.5.2. When opening up the search app the time still defaults to "All Time". Is there something I am missing?

0 Karma
1 Solution

hortonew
Builder

On my search deployer, I made an app for user prefs. Seems to be working.

local/ui-prefs.conf
[search]
dispatch.earliest_time = -5m
dispatch.latest_time = now

metadata/local.meta
[]
access = read : [ * ], write : [ admin ]
export = system

View solution in original post

hortonew
Builder

On my search deployer, I made an app for user prefs. Seems to be working.

local/ui-prefs.conf
[search]
dispatch.earliest_time = -5m
dispatch.latest_time = now

metadata/local.meta
[]
access = read : [ * ], write : [ admin ]
export = system

mdsnmss
SplunkTrust
SplunkTrust

It looks like I was missing the .meta bit. I've encountered that before where I had missed export=system and a setting didn't work. Something I'll be more conscious in looking for now. Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Transforming Financial Data into Fraud Intelligence

Every day, banks and financial companies handle millions of transactions, logins, and customer interactions ...

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...