Security

Where is the CSS file to edit to revert the SplunkWeb UI to the font used before v7.1?

orion44
Communicator

Can you point me to the CSS file to edit to revert the SplunkWeb UI to the font used before v7.1?

Personally, I think the new font is hard to read. It also introduces an extra 8 pixels of spacing for each line at 125% zoom, which is a colossal waste of space.

Before / After images attached for illustration.

shamanov_i
Explorer

I've found sort of workaround for this problem.

We can delete new font files from $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/fonts and keep only Splunk*, droid* and roboto* font files. Splunk will use this fonts after next restart, but in Messages we'll be seeing notification about file modifications.

To remove this notification we can remove lines with deleted font files from *manifest file in your $SPLUNK_HOME folder.

New interface with old fonts:
alt text

dheera
New Member

I did the same and now see following files:

roboto-regular-webfont.woff
roboto-bold-webfont.woff
SplunkIcons.glyphs
droid-sans-mono-webfont.woff
roboto-light-webfont.woff

But still I see same fonts.

Can you please help?

0 Karma

shamanov_i
Explorer

You can clear browser cache and try open Splunk web interface again.

0 Karma

shamanov_i
Explorer

Also, new Splunk UI font doesn't support cyrillic characters and because of that text with cyrillic and latin symbols or with numbers looks disgusting.

ehughes100
Explorer

I haven't tested changing this yet, but ..... In EventsViewer.css I see the following change:
In 7.1
.EventsViewer .default .event {
font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace;
font-size:12px;
margin:0px 0px 0px 0px;
zoom:1;
white-space: pre;
}

In 7.0.3
.EventsViewer .default .event {
font-family:Consolas, Monaco, Courier New, monospace;
font-size:12px;
margin:0px 0px 0px 0px;
zoom:1;
white-space: pre;
}

I assume Inconsolata or Splunk Platform Mono is the new font you see. There is a similar difference in default.css (which maybe gets built from EventsViewer.css??). This doesn't address the cell padding.

Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...