@PickleRick I believe the intent of the original post is memory usage of a newly installed Splunk UF that hasn't been configured with additional `inputs.conf` aside from Splunk's defaults. @hrawat_splunk What, if any, drawbacks are there to setting `max_inactive = 10`? Splunk Support referred me to your post for a support case I filed that matches your original post. ... View more

Assuming I understood your question correctly, I was able to update the default.xml for the 'search' app using: cat test.xml <nav search_view="search" color="#5CC05A"> <view name="search" default="true" /> <view name="analytics_workspace" /> <view name="datasets" /> <view name="reports" /> <view name="alerts" /> <view name="dashboards" /> </nav> curl -ks -u admin:"${pw}" https://localhost:8089/servicesNS/nobody/search/data/ui/nav/default --data-urlencode eai:data@test.xml ... View more