Splunk Search

Where is XML

motobeats
Path Finder

I have a view I want to edit for customization. The URL is below, but I cannot find the xml on the server.

localhost:8001/en-US/manager/search/data/ui/views/Test_1

I thought it would be here:

$SPLUNK_HOME/etc/apps/<app_name>/local/data/ui/views/

But search does not seem to have a local folder.

0 Karma
1 Solution

motobeats
Path Finder

Ok, I found the issue. I was looking in the wrong $SPLUNK_HOME (prior installation). User error.

/splunk/etc/users/admin/search/local/data/ui/views

Thanks lguinn for the right path.

View solution in original post

0 Karma

motobeats
Path Finder

Ok, I found the issue. I was looking in the wrong $SPLUNK_HOME (prior installation). User error.

/splunk/etc/users/admin/search/local/data/ui/views

Thanks lguinn for the right path.

0 Karma

lguinn2
Legend

Ah, how did you create this? Test_1 might be the name of the dashboard, not the name of the file...

0 Karma

motobeats
Path Finder

No search folder for me on that path:

[root@wf-1 admin]# pwd
/opt/splunk/etc/users/admin
[root@wf-1 admin]# ls
user-prefs

[root@wf-1 user-prefs]# pwd
/opt/splunk/etc/users/admin/user-prefs
[root@wf-1 user-prefs]# ls
local metadata

Tried a find at $SPLUNK_HOME and come up empty for Test_1

0 Karma

linu1988
Champion

Yes correct, i was about to suggest that!

0 Karma

lguinn2
Legend

If this is not a shared view, it will probably be under

$SPLUNK_HOME/etc/users/<username>/search/local/data/ui/views/Test_1

motobeats
Path Finder

Under $SPLUNK_HOME/etc/apps/search I only have a bin folder and no files.

0 Karma

Ayn
Legend

Did you check default?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...