Dashboards & Visualizations

Edit a view from and existing app

strueblood
Explorer

I've loaded the Cisco Security App in splunk. I like some of the reports that they provide under views but I need to customize them to our needs. They don't quite extend to the time that we'd like.\

Under the actions menu the edit optioon is not available like it is with a typical view and dashboard.

How can I edit these?

I've already been down the road of app permission, dashboard permissions.

Tags (2)

sideview
SplunkTrust
SplunkTrust

The Edit links in the actions menu are only available for views written in Splunk's 'simplified XML'. The simplified XML is just a sort of macro or shorthand way of writing a view in the underlying 'advanced XML', and most or quite possibly all of the Cisco app's views are written in the advanced XML.

However you can go to Manager, User Interface, Views, and edit any view you see there.

When you save that edited version, Splunk will create a copy of that view at

<splunkHome>/etc/apps/<appName>/local/data/ui/views

and the local vs system distinction should call to mind splunk's layered system for conf files, because that's how it works -- the version of the view in local will override the version in system.

I do not recommend editing the version in the system folder because if and when you upgrade the cisco app to a newer version, your changes would be clobbered.

Genti
Splunk Employee
Splunk Employee

i have not played with the Cisco Security App, but i am assuming this app has a directory (similar to the search app) where you can go and modify what you would like.
/splunk/etc/apps/search/default/data/ui/views - here you can modify the views for the search app, try locating a similar directory for the Cisco Security App and try modifying the xml files in there.

Note, i would recommend making a backup to the directory before you commit any changes.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...