Splunk Search

Selected fileds in splunk UI are not getting saved.

Splunk-Star
Loves-to-Learn Lots

Selected fields in splunk UI are not getting saved, each time again we need to select the fields once logging again to splunk UI.

Labels (1)
0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Splunk-Star 

The user configuration known as "selected fields" is located in $SPLUNK_HOME/splunk/etc/users//user-prefs/local/ui-prefs.conf and is modifiable by interface.
Users can change the default user-prefs.conf file that you set.

The choice is

fields = ["host","source","sourcetype"] in display.events.fields

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Ui-prefsconf#Display_Formatting_Options 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...