- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SplunkBase,
The following question is partially out of curiosity...
When a search string is saved as a report (e.g. a pie chart), where in the conf files is the information dictating the chart/report type used. I looked in the savedsearches.conf file, but there was no reference to the chart type, only to the search string, and some alert based options.
I have flicked through the rest of the App ($SPLUNK_HOME/etc/apps/<app_name/
) directory but could not find a reference to the chart type, etc.
Apologies if I'm asking an obvious question, just haven't referenced this before.
Regards,
MHibbin
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

It's stored in personal viewstates.conf files under etc/users/, which are referenced by the vsid
property in the savedsearches.conf file. However, these can (and should) be overridden by explicit setting if you use the search on an XML dashboard.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

It's stored in personal viewstates.conf files under etc/users/, which are referenced by the vsid
property in the savedsearches.conf file. However, these can (and should) be overridden by explicit setting if you use the search on an XML dashboard.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok thanks I see now.
