I would like to ask a question in relation to the Cisco Security app. I got version 1.0.1. I would like to be able to customize the bar just below the splunk logo
It appears that I cannot change it by putting the default.xml under C:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\local\data\ui\nav
I had to edit the copy in C:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\default\data\ui\nav
to customize it, there's not much about how to work it. Where should I start?
Here is an extract of what happened when I restart splunk to enable the changes?
C:\Program Files\Splunk\bin>splunk start
Splunk> Needle. Haystack. Found.
Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking configuration... Error while parsing 'C:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\default\data\ui\nav\_default.xml': mismatched tag: line 95, column 2
There were problems with the configuration files.
Would you like to ignore these errors? [y/n]:y
Done.
Checking index directory...
Validated databases: _audit _blocksignature _internal _thefishbucket history main summary
Done
i really think the ninjas are too busy at splunk. I often had to ask a question and answer it myself. Even after sending it to splunk support. Nothing came back. It's as good as not having splunk support set up.
Ok, how i fixed my own problem. It's best you have the app installed (and inside it) and edit from User Interface -> Navigation -> default.xml
Chances are that if you try to edit the files via the $SPLUNK_HOME directory, you're going to get yourself in a real mess. The Splunk Manager, if you can get to it will be a better place to edit the files. Use an admin account and make sure the app permission is app. be it read or write, it's up to you.
I tried to do via the files then i was informed by the asia's splunk support: Lye-Hee to do it via the UI and i got it.
Thanks all for your kind attention to even bother reading my questions. The 54 of you guys! Thanks
an upvote for your efforts