ui-prefs.conf
The following are the spec and example files for ui-prefs.conf
.
ui-prefs.conf.spec
# Version 9.0.1 #
OVERVIEW
# This file contains descriptions of the settings that you can use to # configure the ui for a view. # # There is a ui-prefs.conf in $SPLUNK_HOME/etc/system/default directory. # Never change or copy the configuration files in the default directory. # The files in the default directory must remain intact and in their original # location. # # To set custom configurations, create a new file with the name ui-prefs.conf in # the $SPLUNK_HOME/etc/apps/<app_name>/local/ directory. Then add the specific # settings that you want to customize to the local configuration file. # For examples, see ui-prefs.conf.example. You must restart the Splunk instance # to enable configuration changes. # # To learn more about configuration files (including file precedence) see the # documentation located at # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles #
GLOBAL SETTINGS
# Use the [default] stanza to define any global settings. # * You can also define global settings outside of any stanza, at the top of # the file. # * Each .conf file should have at most one default stanza. If there are # multiple default stanzas, settings are combined. In the case of # multiple definitions of the same setting, the last definition in the # file takes precedence. # * If a setting is defined at both the global level and in a specific # stanza, the value in the specific stanza takes precedence. [<stanza name>] * The name of the xml view file dispatch.earliest_time = dispatch.latest_time =
Preference options
display.prefs.autoOpenSearchAssistant = 0 | 1 display.prefs.timeline.height = <string> display.prefs.timeline.minimized = 0 | 1 display.prefs.timeline.minimalMode = 0 | 1 display.prefs.aclFilter = [none|app|owner] display.prefs.appFilter = <string> display.prefs.listMode = [tiles|table] display.prefs.searchContext = <string> display.prefs.events.count = [10|20|50] display.prefs.statistics.count = [10|20|50|100] display.prefs.fieldCoverage = [0|.01|.50|.90|1] display.prefs.enableMetaData = 0 | 1 display.prefs.showDataSummary = 0 | 1 display.prefs.customSampleRatio = <int> display.prefs.showSPL = 0 | 1 display.prefs.livetail = 0 | 1 # Count per page for listing pages countPerPage = [10|20|50]
Display Formatting Options
# General options display.general.enablePreview = 0 | 1 # Event options display.events.fields = <string> display.events.type = [raw|list|table] display.events.rowNumbers = 0 | 1 display.events.maxLines = [0|5|10|20|50|100|200] display.events.raw.drilldown = [inner|outer|full|none] display.events.list.drilldown = [inner|outer|full|none] display.events.list.wrap = 0 | 1 display.events.table.drilldown = 0 | 1 display.events.table.wrap = 0 | 1 # Statistics options display.statistics.rowNumbers = 0 | 1 display.statistics.wrap = 0 | 1 display.statistics.drilldown = [row|cell|none] # Visualization options display.visualizations.type = [charting|singlevalue] display.visualizations.custom.type = <string> display.visualizations.chartHeight = <int> display.visualizations.charting.chart = [line|area|column|bar|pie|scatter|radialGauge|fillerGauge|markerGauge] display.visualizations.charting.chart.style = [minimal|shiny] display.visualizations.charting.legend.labelStyle.overflowMode = [ellipsisEnd|ellipsisMiddle|ellipsisStart] # Patterns options display.page.search.patterns.sensitivity = <float> # Page options display.page.search.mode = [fast|smart|verbose] display.page.search.timeline.format = [hidden|compact|full] display.page.search.timeline.scale = [linear|log] display.page.search.showFields = 0 | 1 display.page.home.showGettingStarted = 0 | 1 display.page.search.searchHistoryTimeFilter = [0|@d|-7d@d|-30d@d] display.page.search.searchHistoryCount = [10|20|50]
ui-prefs.conf.example
# Version 9.0.1 # # This file contains example of ui preferences for a view. # # To use one or more of these configurations, copy the configuration block into # ui-prefs.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to # enable configurations. # # To learn more about configuration files (including precedence) please see the # documentation located at # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles # # The following ui preferences will default timerange picker on the search page # from All time to Today We will store this ui-prefs.conf in # $SPLUNK_HOME/etc/apps/search/local/ to only update search view of search app. [search] dispatch.earliest_time = @d dispatch.latest_time = now
transforms.conf | ui-tour.conf |
This documentation applies to the following versions of Splunk® Enterprise: 9.0.1
Feedback submitted, thanks!