We would like to remind Splunk users to always include an index in their queries. With over 200 indexes it is taxing to search without an index. The idea is to edit the search dashboard in the search app as this is what is most frequently bookmarked.
I've dug around in the search_mrsparkles code for over an hour and can't see to find the code where I could insert a simple div tag with some text to remind the users. I know that it would get overwritten during an upgrade and I am willing to maintain that going forward.
Any pointers?
Thanks!
Paul
↧
