Splunk Search

Selected fileds in splunk UI are not getting saved.

Splunk-Star
Loves-to-Learn Lots

Selected fields in splunk UI are not getting saved, each time again we need to select the fields once logging again to splunk UI.

Labels (1)
0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Splunk-Star 

The user configuration known as "selected fields" is located in $SPLUNK_HOME/splunk/etc/users//user-prefs/local/ui-prefs.conf and is modifiable by interface.
Users can change the default user-prefs.conf file that you set.

The choice is

fields = ["host","source","sourcetype"] in display.events.fields

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Ui-prefsconf#Display_Formatting_Options 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...