I have a requirement to have a custom banner and footer on every single Splunk page in the web interface. I need the ability to control the color and the text on these banners. I have seen examples of customizing the login page and using the bulletin messages, but neither of these solutions were accepted. Are there any other ways to avoid changing the code base? Splunk version 6.5.0.
The best I can tell is that it would be a change in Splunk's base code such in the $SPLUNK_HOME/etc/apps/search/appserver/static/ directory with custom JS and CSS.
ICAP will allow you insert data into HTTP traffic - I imagine the footer/banner directive you've been given will apply to all the stuff you need to support, not just Splunk. So it is probably worth investigating