Why is search syntax highlighting not working in splunk 6.4.2 Enterprise edition?

[samnathan]

1. There is no "Account Settings>Preferences" under User Icon (Splunk Bar in 6.4.2)
2. I have added "local" directory under $SPLUNK_HOME/etc/apps/search/
3. Created file user-prefs.conf.spec.in (by copying user-prefs.conf under$SPLUNK_HOME/etc/apps/search/default)
4. Opened the $SPLUNK_HOME/etc/apps/search/user-prefs.conf.spec.in/ and added the following: search_syntax_highlighting = true search_auto_format = false search_line_numbers = false
5. Restarted the Splunk instance
6. Search syntax highlighting doesn't work

Does this work only in higher versions? Please note it's not a free license version. Kindly help!

[jluo_splunk · Accepted solution]

Hi Samnathan,

Syntax highlighting was introduced in Splunk 6.6, which is why it won't work.