Cannot remove Splunk logo from the footer of the PDF report

[arkadyz1]

I've tried to remove the Splunk logo from my PDF reports by setting reportIncludeSplunkLogo to 0 (zero) in $SPLUNK_HOME/etc/system/local/alert_actions.conf (why is it so difficult to edit that file? All those security restrictions!) and restarting Splunk to no avail. The logo is still there.

I've also changed that flag in etc/apps/search/local/alert_actions.conf (since I'm generating the reports from Search app, I though it might make sense). No luck. I've restarted Splunk a gazillion times after those changes.

Am I doing anything wrong? Or have I skipped a step?

[vince2010091]

Hello,

You can remove the splunk logo by editing this file:

/opt/splunk/lib/python2.7/site-packages/splunk/pdf/pdfrenderer.py

At end of file set the variable "_splunkLogoSvg" to:

"""<svg></svg>"""

This will remove the splunk logo.

Regards,
Vince

[arkadyz1]

Thanks! This is quite hackish, but should help those people with free license. The path is slightly different, though (at least in my Windows Splunk 6.2 installation) - $SPLUNK_HOME/Python-2.7/Lib/site-packages/splunk/pdf/pdfrenderer.py .

[arkadyz1]

Hi, Raghav,
Could you please elaborate in what file exactly have you changed that flag?

[Raghav2384]

alert_actions.conf, My conf file reads

Integrated PDF rendering adds a Splunk logo to the corner of the rendered page

Disable by setting this to 0 (false)

reportIncludeSplunkLogo = 0

[arkadyz1]

Thanks for the quick answer. I think I did not make myself clear enough:
The question was more about the exact location: what's the path to the file relative to $SPLUNK_HOME?

[Raghav2384]

My bad. Here's the path : Splunk/etc/system/local/alert_actions.conf (which you've mentioned already on the primary post). Very Interesting. Cool thing would be, see if you can install Splunk ENT Trial on a different machine and try the above process. If it works, free license needs to be blamed 🙂

[arkadyz1]

I installed Splunk on another computer with Enterprise Trial, changed the flag in etc/system/local/alert_actions.conf (in fact, copied the file from default to local and edited), created an app and a dashboard, and exported into PDF. Lo and behold - no Splunk logo! Seems like free license is to blame, indeed...

[grijhwani]

What "security restrictions" are you complaining about? Basic unix file permissions? If so, they are there for a reason, as a fundamental part of the way that world works. On a multi-user system the system itself is protected from malicious or incompetent users trampling all over important things, and permissions are deliberately compartmentalised so that only those who are supposed to be able to do something to a file can.

It's not hugely difficult to overcome if you have administration rights to the system.

[Raghav2384 · Accepted solution]

As they say, you can just hide it. I tried by turning the value from 1 to 0 and it disappeared.
Edited the value from 1 to 0, restarted splunk and exported the pdf without icon. Catch is, i am running enterprise trial. Free license is my guess, although it typically shouldn't be controlled that way

[splunkn]

Raghav, is there any way to include my client's logo in splunk pdf reports.
I tried with editing the pdfrenderer.py's svg code. However no luck.

Any ideas?

[arkadyz1]

Forgot to mention: I'm still using permanent free license, though our company is going through the process of purchasing one. Is it license related?