Adding a custom banner/footer across the entire Splunk web interface

[jeffrey_charbon]

Hello,

I have a requirement to have a custom banner and footer on every single Splunk page in the web interface. I need the ability to control the color and the text on these banners. I have seen examples of customizing the login page and using the bulletin messages, but neither of these solutions were accepted. Are there any other ways to avoid changing the code base? Splunk version 6.5.0.

The best I can tell is that it would be a change in Splunk's base code such in the $SPLUNK_HOME/etc/apps/search/appserver/static/ directory with custom JS and CSS.

[jplumsdaine22]

RFC 3057 is what you want. https://en.wikipedia.org/wiki/Internet_Content_Adaptation_Protocol

[jeffrey_charbon]

Thank you jplumsdaine22, but I'm not familiar with that protocol nor how it would be implemented to solve my problem. Can you elaborate please?

[jplumsdaine22]

ICAP will allow you insert data into HTTP traffic - I imagine the footer/banner directive you've been given will apply to all the stuff you need to support, not just Splunk. So it is probably worth investigating