Getting Data In

default.xml customization


I would like to ask a question in relation to the Cisco Security app. I got version 1.0.1. I would like to be able to customize the bar just below the splunk logo

It appears that I cannot change it by putting the default.xml under C:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\local\data\ui\nav

I had to edit the copy in C:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\default\data\ui\nav

to customize it, there's not much about how to work it. Where should I start?

Here is an extract of what happened when I restart splunk to enable the changes?

C:\Program Files\Splunk\bin>splunk start

Splunk> Needle. Haystack. Found.
Checking prerequisites...
        Checking http port [8000]: open
        Checking mgmt port [8089]: open

        Checking configuration... Error while parsing 'C:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\default\data\ui\nav\_default.xml': mismatched tag: line 95, column 2

There were problems with the configuration files.

Would you like to ignore these errors? [y/n]:y

        Checking index directory...
        Validated databases: _audit _blocksignature _internal _thefishbucket history main summary

Tags (2)


i really think the ninjas are too busy at splunk. I often had to ask a question and answer it myself. Even after sending it to splunk support. Nothing came back. It's as good as not having splunk support set up.

Ok, how i fixed my own problem. It's best you have the app installed (and inside it) and edit from User Interface -> Navigation -> default.xml

Chances are that if you try to edit the files via the $SPLUNK_HOME directory, you're going to get yourself in a real mess. The Splunk Manager, if you can get to it will be a better place to edit the files. Use an admin account and make sure the app permission is app. be it read or write, it's up to you.

I tried to do via the files then i was informed by the asia's splunk support: Lye-Hee to do it via the UI and i got it.

Thanks all for your kind attention to even bother reading my questions. The 54 of you guys! Thanks

Path Finder

an upvote for your efforts

0 Karma
Get Updates on the Splunk Community!

About Time picker tokens

I would like to search from 600 seconds before to 600 seconds after the time specified in the time picker on ...

tag as datamodel attribute

I'm confused a bit. I use CIM datamodels.The "tag" field is both a filter for choosing events applicable to a ...

Running multiple macros in the same search

Hi all!I'm trying to run multiple macros in the same search and eventually aggregate the results from each ...