All Apps and Add-ons

Custom Visualization "precedence"



I am about to use the horizon_chart visualization located in on "visualizations app (VIS_APP)" i created, so I copied the structured tree to my app and defined visualizations.con and default.meta in order to use it in order apps.

It works just fine.

But if I had horizon_chart_app installed, my dashboards return an error saying they can't find horizon_chart visualization in VIS_APP. If I disable horizon_chart_app, it returns to work.

What is happening? What makes Splunk look into horizon_chart_app by default even when I tell him to look at one specific app VIS_APP?


0 Karma


Hi Tiago,

I faced the same problem recently and changing the visualization's name inside of my app did the trick. All you have to do is change the name to "horizon_chart_viz", or any other name, as long as it is different from the original visualization's name:

  • Change the visualization stanza inside the "visualizations.conf" file to "[horizon_chart_viz]"
  • Change the visualizations stanza on the "default.meta" file to "[visualizations/horizon_chart_viz]"
  • Change the name of the folder containing the visualization to "horizon_chart_viz" (on /etc/apps//appserver/static/visualizations/)

And you're good to go 🙂

0 Karma


@TiagoTLD1 Horizon Chart is one of Splunk's Custom Visualization (similar to inbuilt visualizations but available as individual apps on Splunkbase). This can be either made available only to System app or All Apps from Horizon Chart > App Permission settings:


You dont need to explicitly more the files to other folders.

There are several Custom Visualization available on Splunkbase like Timeline Custom Visualization, Punchcard Custom Visualization etc ( In fact Splunk has made Custom Visualization API available since Splunk Enterprise 6.4 onward (current version is supported on 6.5 and 6.6) which you can code as per your needs for any visualization you need (

| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...