Change the default Search preferences for all users
The previous sections describe how individual users can change the default Search preferences for syntax highlighting, auto-formatting, and line numbering features for themselves.
The default Search preferences can also be changed globally for all users.
Prerequisites
- Only users with file system access, such as system administrators, can change the default Search preferences for all users. If you are using Splunk Cloud Platform and want to change the default Search settings for your Splunk system, open a Support ticket.
- Review the steps in How to edit a configuration file in the Admin Manual.
Note: Never change or copy the configuration files in the
default directory. The files in the default directory must remain intact and in their original location. Make the changes in the local directory.Steps
- Open the local
user-prefs.conffile for the Search app. For example,$SPLUNK_HOME/etc/apps/search/local. - Under the [general] stanza, you can change the settings listed in the following table.
Feature Attribute syntax Default setting Advanced editor, which includes syntax highlighting search_use_advanced_editor = <boolean> true Color theme search_syntax_highlighting = light, dark, or default-system-theme default-system-theme Auto-formatting search_auto_format = <boolean> false Line numbering search_line_numbers = <boolean> false - Restart the Splunk instance.