topic How to customize my own event display but keep the "highlight effect" ? in Splunk Search

How to customize my own event display but keep the "highlight effect" ?

leo_wang — Sat, 16 Oct 2010 23:48:33 GMT

I recently followed this document to customize the event display for my own eventtype : http://www.splunk.com/base/Documentation/4.1.5/Developer/EventRendering

It's quite interesting and useful, but I found the "highlight effect" of search keyword would be malfunctioned in my customized display. I know I should put some special code in my template to creat this effect, but I don't know how....

Any tips or reference ?

Leo Wang

Re: How to customize my own event display but keep the "highlight effect" ?

gkanapathy — Sun, 17 Oct 2010 03:50:23 GMT

Looks to me like you would need to define a highlight color for the matched terms class, such as:

.myEventRendererClass .a {
  background-color: #F5E998;
}

Re: How to customize my own event display but keep the "highlight effect" ?

leo_wang — Fri, 22 Oct 2010 18:42:29 GMT

Thanks for your response. but it seems not working in my case. My simple event-rendering template is like this , which just use the field value to display my event data.

<%page args="job, event, request, options" />
<% mydate = event.fields.get('date','') %>
<% mycase = event.fields.get('CaseDetail','No example') %> 
<% mydetail = event.fields.get('detail','none') %>
  <span id="eventTypeForm"/>
     <table border=1>
        <tr><td> <b>Date:</b> ${mydate|h}<br/> </td> <td>  <b>Rule :</b>${myrule|h}<br/> </td> </tr>
         <tr><td colspan=2> ${mydetail} </td> </tr>
     </table>

</div>

enter code here

Re: How to customize my own event display but keep the "highlight effect" ?

gkanapathy — Fri, 05 Nov 2010 20:52:54 GMT

Have you specified/defined the appropriate CSS class?

Re: How to customize my own event display but keep the "highlight effect" ?

wollinet — Mon, 28 Sep 2020 09:10:39 GMT

Have a look here:

http://answers.splunk.com/questions/4937/custom-event-renderer

I had the same problem. If you exactly know how your event looks like and you have a predefined set of fields you can try putting this aroung your fields:

SOME_VALUE_HERE