Create a custom web page for the Splunk web server to host

[jones4bob]

Is there a way to create a simple web page that I can serve up from the Splunk server? I'm not at the point where I can create a custom app.

I have Afterglow (the script, not the app) working and I would like to pipe some firewall logs into afterglow (and neato) to generate a graph of some network traffic every few minutes. If I could host a page locally, I could point my browser to this page and use a simple refresh to keep showing an image of the last few minutes of traffic. This can act as an alert to suspicious activity when the image changes dramatically from the norm.

[Lowell · Accepted solution]

You can easily host static web content (.html, .css, .js, etc), if that's what your asking about. All you have to do is drop your web files in an application folder under the "appserver" "static" folder, for example:

$SPLUNK_HOME/etc/apps/<YOUR_APP>/appserver/static/<my_page.html>

You can then access that file via HTTP at the following location:

http://<YOUR_SPLUNK_SERVER>:8000/en-US/static/app/<YOUR_APP>/<my_page.html>;

I would suggest creating a custom app for this kind of stuff, even if it only contains a few few files. Creating a new "app" isn't a very difficult process. (Of course, you could simply host this file in an existing app, but then you run the risk of your stuff being overwritten during an upgrade.)