You're welcome! Just sharing in case others in the community run across the same issue. 🙂 ... View more

Fantastic! Glad that did it for you! And thanks for sharing the final results that worked best for you! ... View more

This is done by modifying the navigation menu which is defined in the default.xml file located in the following path: $SPLUNK_HOME/etc/apps//default/data/ui/nav/ You can find more information on this as well as how to make other customizations similar to this here: http://dev.splunk.com/view/SP-CAAAEP9 The actual views or the content of the landing page will go in: $SPLUNK_HOME/etc/apps//default/data/ui/views/ The static content for the HTML files go into the following paths: $SPLUNK_HOME/etc/apps/your_app_name/appserver/static/ Under here you would have directories and associated files for html, css, images, and js. Here's some documentation around this too: https://docs.splunk.com/Documentation/Splunk/7.1.1/AdvancedDev/UseCSS ... View more

PDAIGLE came up with the correct answer in one of the comments below! ... View more

Yes, that's exactly what I was trying to do. But I think since we now have the Eventgen on splunkbase.splunk.com (or at least a reference so that people can go download it and use it) I'll do what you recommended and just keep the eventgen/ separate. I just did a test run of the app I'm creating with the eventgen.conf and samples/ directory in my app and then installed the eventgen via the Splunk web gui and it worked fine. Yes, its another step for people, but it keeps the package clean and plus, I do want to upload this one to splunkbase.splunk.com. Thanks Jason! ... View more

tried this trick, but does not work. The contents of those files before and after click "Apply Changes" are now identical, except the order in etc/system/local/distsearch.conf may vary. Some how clicking that button results some randomness in order ... View more

Here's what I could find on this: appOrder: A per user app order is maintained within /services/data/user-prefs endpoint, under the appOrder key A default app order is specified in etc/apps/user-prefs/default/user-prefs.conf By default, appOrder=search, causing the search app to appear first in the UI. display.page.home.dashboardId: When users first view the new home page, they will see a call-to-action for choosing their home dashboard. The id for their selected dashboard is stored in userprefs.conf as the field "display.page.home.dashboardId." eai_app_only: Working on this one.....not sure but it always seems to be set to False. Will update as soon as I get an answer. eai_results_per_page: Tells the number of results you get when you search. If you go to e.g. settings/all configurations, it will show you 100 items each page. restart_background_jobs: Restart background search job that has not completed when Splunk Enterprise restarts indication: true = Restart job. false = Do not restart job. showWhatsNew: A per user "showWhatsNew" flag is maintained within /services/data/user-prefs endpoint. By default, the value is set to "1", indicating to the UI that the dialog should be displayed. When the dialog is closed, the value is changed to 0. This will happen no matter where the user is when they close the dialog (not just on home). I'll provide an update on the "eai_app_only" parameter once I hear back from others. PD2 ... View more