Splunk Search

Issue with real-time searches for metadata running because of ui-prefs.conf settings.

simranrathi123
Engager

When we launch Splunk Home or Search page, there is this metadata that runs in real-time eating up our resources available at hand.

|metadata type=sourcetypes | search totalcount>0

I have read other answers here in the forum that say it can be disabled by changing the config at ui-prefs.conf.

My question is: What would be any repercussions of performing this tweak - is this search actually being used somewhere else?
Actually, what is the purpose/benefit/importance of this search?

Labels (1)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!