I know this is 5 years later, but I had the same issue and this is where Google took me. IMO the easiest way to fix this after several hours of various attempts is to run (on Linux at least): pgrep -f "persistconn/appserver.py" | xargs kill -9 This will kill the persistent app server. It restarts pretty quickly (instantly on my dev box) and changes will be registered. I run it after every save now.    ... View more

I ended up using the authhandlers.py script in $SPLUNK_HOME/etc/apps/rest_ta/bin Used python to get a new token every hour, referenced that function in the ui for rest. ... View more

Thank you @Goesta I havve read the thread but it's far from the requirement I need. But I appreciate your efforts for this. ... View more

From what I found saving settings in "Edit Incident" window requires 'admin_all_objects' and 'edit_tcp' capabilities in 2.0.5. Security-wise that's a disaster. ... View more

oh, and the x axis, just add some eval to replace after charting... | chart max(time) as max_time by datex | eval datex = strftime(datex, "%d/%m") ... View more

Is there anyway to specify the same range when using the sparkline function in a search? We are embedding the report, so I can't use a dashboard. Thanks! ... View more