Dashboards & Visualizations

Looking for a simple (emphasis on "simple") way to revert to v5 UI functionality on a v6 installation.

Motivator

I REALLY do not like the new v6 UI. It is too kludgy. Too much time-wasting back and forth.

  • I don't like the fact that the general navigation bar is always off the top of the window and that I have to deliberately scroll back to reveal it every time I want to use it.

  • I don't like the fact that the menu buttons no longer lead to interactive drop-downs.

  • I don't like the fact that to select a report in full search mode I have to go to the reports page, run the report, then expressly RE-open it in search.

  • The fonts are bigger and styling now uses more space, meaning that too is wasteful of screen estate and adds to the manual scrolling overhead.

  • Next/prev (in search) only at the top of the page not the bottom which means scrolling back to the top to scroll through result pages. - OK, not so bad because the bar floats down the page during scrolling

The ideal solution would be to retrofit the complete v5 UI as far as possible across the board. Is there a nice simple way of doing this without having to dig manually into the XML?

Tags (3)
0 Karma
1 Solution

Motivator

Well it seems a partial answer is to simply move the v6 default search app aside (i.e. move the ~splunk/etc/apps/search directory to a different name, and replace it with a copy of same from v5. That brings back all the downs, and gets rid of the clunky flip-between-pages-to-select-a-report nonsense. It remains to be seen whether the report-maintenance side of things will handle the UI change or just get thoroughly confused. And it also doesn't change the fact that running a report from the search app requires to then explicitly re-open it in the search dialogue to get the search parameters visible again (which again is a clunky, unnecesssary step).

So far everything I have seen of the changes to v6 are in user interaction, and they are at best "unhelpful". Sorry to say I am REALLY unimpressed. Certainly won't be upgrading the work platform past v5.0.5 for the forseeable future.

View solution in original post

Motivator

Bump. Wondering if - a year later - anyone has had any real success retro-fitting the v5 UI onto v6? I really loathe the v6 unfriendliness (or over-friendliness, depending on your design ethos).

0 Karma

Motivator

Well it seems a partial answer is to simply move the v6 default search app aside (i.e. move the ~splunk/etc/apps/search directory to a different name, and replace it with a copy of same from v5. That brings back all the downs, and gets rid of the clunky flip-between-pages-to-select-a-report nonsense. It remains to be seen whether the report-maintenance side of things will handle the UI change or just get thoroughly confused. And it also doesn't change the fact that running a report from the search app requires to then explicitly re-open it in the search dialogue to get the search parameters visible again (which again is a clunky, unnecesssary step).

So far everything I have seen of the changes to v6 are in user interaction, and they are at best "unhelpful". Sorry to say I am REALLY unimpressed. Certainly won't be upgrading the work platform past v5.0.5 for the forseeable future.

View solution in original post

Motivator

And change the default start-up to jump straight into the search app:
change ~splunk/etc/users/admin/user-prefs/local# cat user-prefs.conf
[general]
default_namespace = search
...

0 Karma

Motivator

I have also found that it requires digging into the CSS to revert fonts to more efficient and recognisable defaults.

Here's a start:
/opt/splunk/share/splunk/search_mrsparkle/exposed/css/bootstrap.min.css
:%s/"Roboto",//g
:%s/"Droid",//g
:%s/"Helvetica Neue",//g

/opt/splunk/share/splunk/search_mrsparkle/exposed/css/pages/search-bootstrap.min.css
:%s/'Droid Sans Mono',//g
:%s/Consolas,//g
:%s/Monaco,//g
:%s/"Droid Sans Mono",//g
:%s/"Consolas",//g
:%s/"Monaco",//g

0 Karma

Path Finder

Taking the "emphasis on simple" comment, how about installing a second copy of v5.0 on the same server but in a different directory and listening on a different port? It can use your existing indexers and the load from having it sit idle as you start to use the version 6 console will be negligible.

This assumes you and your users aren't making use of the version 6 code yet within your apps.

0 Karma

Motivator

Probably quite correct. Historically Splunk's distributed search has always been backward compatible with the prior version of indexer, but because of technology/protocol changes new indexers are quite often not backward-compatible with the older version of distributed search.

This is why my standard upgrade sequence is always search head first, followed by non-critical indexer(s), and finally the critical indexers, making sure any wrinkles are ironed out at each step before moving to the next.

0 Karma

Path Finder

According to the documentation, and direction I got from Splunk support when I inquired, a v5 search instance won't work with v6 indexers. Have you found mixing search and indexer versions like this to work?

0 Karma

Motivator

I'm not, but I AM using Splunk Free at home as my first testbed for migrating to v6 on Enterprise at work, and once I upgrade the indexers there I don't want to have to hold the search head back. And the impression of v6 is nippy but clunky interaction.

I want a way of fixing the UI ahead of time, so I don't get earfuls of complaints, not holding the search head back (which is the simplest option). If I don't like it the end users not going to like it any better.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!