topic Re: Splunk 6 - Customize Search App Views in Splunk Search

Splunk 6 - Customize Search App Views

lguinn2 — Thu, 06 Mar 2014 22:39:47 GMT

In Splunk 5, it was possible to customize the two basic views in the Search App: flashtimeline and dashboard_live.
These views still exist in Splunk 6, but the Search App does not use them. Instead, the default search is listed in the URI as .../app/search/search, but search.xml is just a shell - there is no content there.

How can I customize the default Splunk 6 search views to

1 - set a different time range default (Last 24 hours) instead of All Time?
[Answer to question 1 is here: How to set the default search time in Splunk 6?]

2 - change how the Interesting Fields display? For example, in Splunk 5 you could exclude fields (like date_*) from appearing in the sidebar. I know about ui-prefs.conf, but it doesn't control whether specific fields appear.

Re: Splunk 6 - Customize Search App Views

fk319 — Wed, 23 Apr 2014 12:28:47 GMT

in 5, I could include a "index=unix" in the search bar automatically.

Re: Splunk 6 - Customize Search App Views

chris — Tue, 01 Jul 2014 14:17:22 GMT

Hi Lisa did you ever find an answer to this question?

Re: Splunk 6 - Customize Search App Views

the_wolverine — Wed, 16 Jul 2014 00:17:54 GMT

You can modify the default.xml to use flashtimeline instead of search app:

Instead of using search in default.xml:

<nav search_view="search" color="#65A637">
  <view name="search" default='true' />
  <view name="data_models" />
  <view name="reports" />
  <view name="alerts" />
  <view name="dashboards" />
</nav>

Use (I just swapped flashtimeline in place of search) and added another line for dashboard_live.

<nav search_view="search" color="#65A637">
  <view name="flashtimeline" default='true' />
  <view name="dashboard_live" />
  <view name="data_models" />
  <view name="reports" />
  <view name="alerts" />
  <view name="dashboards" />
</nav>

Re: Splunk 6 - Customize Search App Views

lguinn2 — Wed, 16 Jul 2014 07:11:33 GMT

Well, yes, but then you lose some of the functionality in the new search view...

Re: Splunk 6 - Customize Search App Views

lguinn2 — Wed, 16 Jul 2014 07:12:00 GMT

Nope, still looking for an answer... but haven't done any recent research

Re: Splunk 6 - Customize Search App Views

lmyrefelt — Wed, 16 Jul 2014 08:02:48 GMT

Hi, i believe the way to go is with a django template with the new web framework ?

However, it is possible, to put a new .html file into

share/splunk/search_mrsparkle/templates/pages/

And add whatever css, js and so to customize the "default" layout, view of search(if editing app.html)
If you add a new .html file into

share/splunk/search_mrsparkle/templates/pages/

Then you need to link to this file inside your xml code for "search" / whatever 🙂

Re: Splunk 6 - Customize Search App Views

lmyrefelt — Wed, 16 Jul 2014 08:11:28 GMT

well, at least, please don't tell me we have totally lost that ability.

Re: Splunk 6 - Customize Search App Views

lmyrefelt — Wed, 16 Jul 2014 08:13:59 GMT

Maybe some help here;

http://dev.splunk.com/view/SP-CAAAEU3

Re: Splunk 6 - Customize Search App Views

the_wolverine — Fri, 18 Jul 2014 20:08:42 GMT

Spent way too much time trying to figure this out and have lost interest in trying to do this.

Re: Splunk 6 - Customize Search App Views

lmyrefelt — Sun, 17 Aug 2014 06:53:00 GMT

You will find the answer in the ; Splunk web framework Toolkit . There is an example on how to create your on "splunk search" view , with the possibility of controlling the content, search, time, loading different css and js, etc etc

http://apps.splunk.com/app/1613/

Re: Splunk 6 - Customize Search App Views

lguinn2 — Mon, 18 Aug 2014 11:18:56 GMT

Thanks for the pointer. And that is probably the answer, although I will need to research further.

It was just so much easier to change a few attributes in an XML file to do simple things like set default values. In Splunk 6, we can customize anything, but the cost may be that there is no simple way to set simple things.