Do you want to customize Splunk by:
- Extending the default choices of 10, 20 and 50 results per page?
- Changing the default number of search results?
This quick how to describes how to implement both of these changes.
Start by making a custom local copy of configuration file that we are about to change:
cp –p $SPLUNK_HOME/etc/apps/$APPNAME/default/data/ui/views/flashtimeline.xml \
$SPLUNK_HOME/etc/apps/$APPNAME/local/data/ui/views/flashtimeline.xml
$APPNAME is your app or search for the default search app
Extend the XML Count options with some extra XML like so:
<module name ...