How to remove the "| Splunk" addition and the green arrow icon from the title in our browser tab in Splunk 6.2?

[arkadyz1]

In our company, we have to remove all Splunk mentions from our applications. I succeeded in hiding or removing most or all of that from the screen. However, if I look at the top of the browser, the tab still shows the title of "Our dashboard name | Splunk" and a green "arrow" icon.

Is there any setting to change this? Maybe some .css, .js, .conf or .py to modify?

[nandhuid]

Hi Arkadyz1,
Could you please share how you removed the splunk logo that appears on top left corner in all the pages (licensing, add data etc...) and the footer in all the pages.

[arkadyz1]

It's a long story - there are many places where that 'splunk' text (it's a text, not an image) resides. You might want to look for splunk<strong>&gt; inside .js and .css files under $SPLUNK_HOME. Be aware, though - if you replace splunk with other letters, the text will look really ugly - the font is Splunk-specific, and it seems that anything but 'splunk' looks really bad in it. I would totally remove that strong tag as well - Splunk .css files have some strange strong:after definitions...

[arkadyz1 · Accepted solution]

I did solve the problem of the document.title (by the way, it does not work at $(document).ready time). It is quite a hacking approach, but we, as an OEM, really had to hide Splunk mentions from everywhere.
There are three files which need changing (actually just two, because we, as an OEM, also have to hide Searching & Reporting from our end users). $(static_dir) below refers to the folder we define as static_dir in web.conf:

$(static_dir)/js/build/bundles/common.js: find "| Splunk %s" there and replace it with our text. %s is used to display the Splunk version, so it does need removing. This, though, affects only the Search screens and is not exactly relevant to our end product.

$(static_dir)/js/build/accountpage.js: find "| Splunk" and replace it. Affects the login page.

$SPLUNK_HOME/ share/splunk/search_mrsparkle/templates/dashboards/dashboard.html: find "| Splunk" and replace it. I found out the hard way that setting template_dir in web.conf does not work - one needs to go to the original search_mrsparkle tree.

[trsavela]

The favorite icons is here:

$SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/img/favicon.ico

You should be abel to change it there with your companies. I'm almost sure this will not survive an update/upgrade.

You may need to clear your browser cache to get the new icon to display.

[arkadyz1]

Thanks again. I will try to add it where I can. I'm concerned about login screen - will probably end up editing login.html for that (again - not concerned much about updates at the moment).

I only hope that the perioding refreshing of the page (definitely happening on the real-time dashboards, probably on others) will not stomp my puny efforts to re-brand the title.

[arkadyz1]

Thanks for the quick answer. Yes, I'm aware of that icon. I also found out that our particular installation uses favicon.ico and not favicon_enterprise, favicon_hunk or favicon_lite.

Of course, the "will not survive an update" part is very important but manageable. Since our particular instance will be on the computers with no Internet access, the update will be conducted by us and we can include the icon replacement into our update procedure.

Anyway, I'm more concerned about what can be done to eliminate that '| Splunk' in the title. It must be produced by the JavaScript, since the initial title value is 'Loading...' and it's not what I see :).

[trsavela]

For the title a little JS helps:

<script type="text/javascript">

    $(document).ready(function() {
        document.title = 'blah';
    });

</script>