Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Where is XML
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a view I want to edit for customization. The URL is below, but I cannot find the xml on the server.
localhost:8001/en-US/manager/search/data/ui/views/Test_1
I thought it would be here:
$SPLUNK_HOME/etc/apps/<app_name>/local/data/ui/views/
But search does not seem to have a local folder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok, I found the issue. I was looking in the wrong $SPLUNK_HOME (prior installation). User error.
/splunk/etc/users/admin/search/local/data/ui/views
Thanks lguinn for the right path.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok, I found the issue. I was looking in the wrong $SPLUNK_HOME (prior installation). User error.
/splunk/etc/users/admin/search/local/data/ui/views
Thanks lguinn for the right path.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ah, how did you create this? Test_1 might be the name of the dashboard, not the name of the file...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No search folder for me on that path:
[root@wf-1 admin]# pwd
/opt/splunk/etc/users/admin
[root@wf-1 admin]# ls
user-prefs
[root@wf-1 user-prefs]# pwd
/opt/splunk/etc/users/admin/user-prefs
[root@wf-1 user-prefs]# ls
local metadata
Tried a find at $SPLUNK_HOME and come up empty for Test_1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes correct, i was about to suggest that!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If this is not a shared view, it will probably be under
$SPLUNK_HOME/etc/users/<username>/search/local/data/ui/views/Test_1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Under $SPLUNK_HOME/etc/apps/search I only have a bin folder and no files.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you check default?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
A Four-Part Event Series: Full Stack Observability For the AI Era
SOC4Kafka - New Kafka Connector Powered by OpenTelemetry
Event Series: Level up your SOC: Advancing with Splunk Enterprise Security
