Splunk Search

Issue with real-time searches for metadata running because of ui-prefs.conf settings.

simranrathi123
Engager

When we launch Splunk Home or Search page, there is this metadata that runs in real-time eating up our resources available at hand.

|metadata type=sourcetypes | search totalcount>0

I have read other answers here in the forum that say it can be disabled by changing the config at ui-prefs.conf.

My question is: What would be any repercussions of performing this tweak - is this search actually being used somewhere else?
Actually, what is the purpose/benefit/importance of this search?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...