Any idea how to change the 'click to search' behavior in 4.1.2? Specifically I want to disable the feature that allows a user to click on text in the search result (automatically adding that text to the query & running the new search). I know in 3.4 it was possible (see www.splunk.com/base/documentation/3.4/user/changesplunkwebpreferences) but I can't find the equivalent configuration option in 4.1.2. Is it changeable? If so, can it be done on an individual user basis? Thanks!
Yes it is changeable. You can modify the default search screen by editing the view $SPLUNK_HOME/etc/apps/search/default/data/ui/views/flashtimeline.xml
.
(Or better copy the flashtimeline.xml to $SPLUNK_HOME/etc/apps/search/local/data/ui/views/
and edit it there)
Look for the EventsViewer module and change its parameters.
<module name="EventsViewer" layoutPanel="resultsAreaLeft">
<param name="segmentation">full</param>
<param name="reportFieldLink">report_builder_format_report</param>
<param name="enableBehavior">False</param>
<param name="enableTermSelection">False</param>
</module>
(I've added the enableBehavior
and enableTermSelection
parameters)
To get a list of all supported parameters for the EventsViewer module, you can take a look at the documentation in your Splunk instance at http://<yoursplunkserver>:8000/modules
.
To get different search views for different users, you will probably need to either build a separate search view or a separate app. But its doable.
Yes it is changeable. You can modify the default search screen by editing the view $SPLUNK_HOME/etc/apps/search/default/data/ui/views/flashtimeline.xml
.
(Or better copy the flashtimeline.xml to $SPLUNK_HOME/etc/apps/search/local/data/ui/views/
and edit it there)
Look for the EventsViewer module and change its parameters.
<module name="EventsViewer" layoutPanel="resultsAreaLeft">
<param name="segmentation">full</param>
<param name="reportFieldLink">report_builder_format_report</param>
<param name="enableBehavior">False</param>
<param name="enableTermSelection">False</param>
</module>
(I've added the enableBehavior
and enableTermSelection
parameters)
To get a list of all supported parameters for the EventsViewer module, you can take a look at the documentation in your Splunk instance at http://<yoursplunkserver>:8000/modules
.
To get different search views for different users, you will probably need to either build a separate search view or a separate app. But its doable.
Any updates to this for SimpleXML or HTML/JS Splunk 6.X?