Change Splunk Web preferences

Change Splunk Web preferences

Use the Preferences panel to configure Splunk Web's default search properties and general appearance and behavior. The Preferences panel is a dialog box that opens when you click the Preferences link in the upper righthand corner of Splunk Web. Access the link on any of the dashboard pages.

The Preferences panel has two tabbed options: Search and General.

Change default settings in search preferences

Use the Search preferences tab to change:

• The default time range.
• The maximum search results.
• How Splunk Web handles segment selection.

Change default time range

To set the default time range for search, select one of the following options:

• Last 15 minutes
• Last 60 minutes
• Last 3 hours
• Last 24 hours
• Last 7 days
• Last Month
• Last 3 Months
• All time

You can always change the time range at search time from the dashboard.

Change maximum search results

The maximum search results is the maximum number of events Splunk will return when you search. By default, this limit is 50k for 64-bit systems and 10k for 32-bit systems. Increasing or decreasing this number will affect Splunk's search speed.

Note: Increasing this number raises the maximum per-search memory cost and can negatively impact your Splunk server's performance.

Change segment selection

This setting affects how the browser interacts with Splunk and may speed up the display of search results. Splunk Web's segmentation setting is not related to indexing segmentation.

You can set segment selection to:

• Raw: Disables segmentation entirely. This is the fastest setting, but disables clicking on events.
• Inner: Enables only minor breakers.
• Outer: Enables only major breakers.
• Full: Default setting, enables both inner and outer segmentation.
• Pyramid: Enables visualizing of event's segmentation.

Change default settings in general preferences

Use the General preferences tab to define:

• A default theme for Splunk Web.
• Click behavior.

Change default theme

Splunk Web is defined with HTML, CSS, Javascript, and XSL. You can customize a theme with CSS files to override the default styles for font, color, and images. If you want to customize Splunk Web's appearance, refer to the Developer manual. You can also watch this Splunk developer video about it.

Change click behavior

You can click on sections of your search results to add or replace terms in your search. "Click behavior" configures either ctrl or ctrl-click to add and replace terms when narrowing your search.

• Was this topic useful?
• Post a comment