ui-prefs.conf
The following are the spec and example files for ui-prefs.conf
.
ui-prefs.conf.spec
# Version 7.0.0 # # This file contains possible attribute/value pairs for ui preferences for a # view. # # There is a default ui-prefs.conf in $SPLUNK_HOME/etc/system/default. To set # custom configurations, place a ui-prefs.conf in # $SPLUNK_HOME/etc/system/local/. To set custom configuration for an app, place # ui-prefs.conf in $SPLUNK_HOME/etc/apps/<app_name>/local/. For examples, see # ui-prefs.conf.example. You must restart Splunk to enable configurations. # # To learn more about configuration files (including precedence) please see the # documentation located at # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles
GLOBAL SETTINGS
# Use the [default] stanza to define any global settings. # * You can also define global settings outside of any stanza, at the top of # the file. # * Each conf file should have at most one default stanza. If there are # multiple default stanzas, attributes are combined. In the case of # multiple definitions of the same attribute, the last definition in the # file wins. # * If an attribute is defined at both the global level and in a specific # stanza, the value in the specific stanza takes precedence. [<stanza name>] * Stanza name is the name of the xml view file dispatch.earliest_time = dispatch.latest_time = # Pref only options display.prefs.autoOpenSearchAssistant = 0 | 1 display.prefs.timeline.height = <string> display.prefs.timeline.minimized = 0 | 1 display.prefs.timeline.minimalMode = 0 | 1 display.prefs.aclFilter = [none|app|owner] display.prefs.appFilter = <string> display.prefs.listMode = [tiles|table] display.prefs.searchContext = <string> display.prefs.events.count = [10|20|50] display.prefs.statistics.count = [10|20|50|100] display.prefs.fieldCoverage = [0|.01|.50|.90|1] display.prefs.enableMetaData = 0 | 1 display.prefs.showDataSummary = 0 | 1 display.prefs.customSampleRatio = <int> display.prefs.showSPL = 0 | 1 display.prefs.livetail = 0 | 1 # count per page for listing pages countPerPage = [10|20|50]
Display Formatting Options
# General options display.general.enablePreview = 0 | 1 # Event options display.events.fields = <string> display.events.type = [raw|list|table] display.events.rowNumbers = 0 | 1 display.events.maxLines = [0|5|10|20|50|100|200] display.events.raw.drilldown = [inner|outer|full|none] display.events.list.drilldown = [inner|outer|full|none] display.events.list.wrap = 0 | 1 display.events.table.drilldown = 0 | 1 display.events.table.wrap = 0 | 1 # Statistics options display.statistics.rowNumbers = 0 | 1 display.statistics.wrap = 0 | 1 display.statistics.drilldown = [row|cell|none] # Visualization options display.visualizations.type = [charting|singlevalue] display.visualizations.custom.type = <string> display.visualizations.chartHeight = <int> display.visualizations.charting.chart = [line|area|column|bar|pie|scatter|radialGauge|fillerGauge|markerGauge] display.visualizations.charting.chart.style = [minimal|shiny] display.visualizations.charting.legend.labelStyle.overflowMode = [ellipsisEnd|ellipsisMiddle|ellipsisStart] # Patterns options display.page.search.patterns.sensitivity = <float> # Page options display.page.search.mode = [fast|smart|verbose] display.page.search.timeline.format = [hidden|compact|full] display.page.search.timeline.scale = [linear|log] display.page.search.showFields = 0 | 1 display.page.home.showGettingStarted = 0 | 1 display.page.search.searchHistoryTimeFilter = [0|@d|-7d@d|-30d@d] display.page.search.searchHistoryCount = [10|20|50]
ui-prefs.conf.example
# Version 7.0.0 # # This file contains example of ui preferences for a view. # # To use one or more of these configurations, copy the configuration block into # ui-prefs.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to # enable configurations. # # To learn more about configuration files (including precedence) please see the # documentation located at # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles # # The following ui preferences will default timerange picker on the search page # from All time to Today We will store this ui-prefs.conf in # $SPLUNK_HOME/etc/apps/search/local/ to only update search view of search app. [search] dispatch.earliest_time = @d dispatch.latest_time = now
transforms.conf | ui-tour.conf |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0
Feedback submitted, thanks!