Security

Where is the CSS file to edit to revert the SplunkWeb UI to the font used before v7.1?

orion44
Communicator

Can you point me to the CSS file to edit to revert the SplunkWeb UI to the font used before v7.1?

Personally, I think the new font is hard to read. It also introduces an extra 8 pixels of spacing for each line at 125% zoom, which is a colossal waste of space.

Before / After images attached for illustration.

shamanov_i
Explorer

I've found sort of workaround for this problem.

We can delete new font files from $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/fonts and keep only Splunk*, droid* and roboto* font files. Splunk will use this fonts after next restart, but in Messages we'll be seeing notification about file modifications.

To remove this notification we can remove lines with deleted font files from *manifest file in your $SPLUNK_HOME folder.

New interface with old fonts:
alt text

dheera
New Member

I did the same and now see following files:

roboto-regular-webfont.woff
roboto-bold-webfont.woff
SplunkIcons.glyphs
droid-sans-mono-webfont.woff
roboto-light-webfont.woff

But still I see same fonts.

Can you please help?

0 Karma

shamanov_i
Explorer

You can clear browser cache and try open Splunk web interface again.

0 Karma

shamanov_i
Explorer

Also, new Splunk UI font doesn't support cyrillic characters and because of that text with cyrillic and latin symbols or with numbers looks disgusting.

ehughes100
Explorer

I haven't tested changing this yet, but ..... In EventsViewer.css I see the following change:
In 7.1
.EventsViewer .default .event {
font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace;
font-size:12px;
margin:0px 0px 0px 0px;
zoom:1;
white-space: pre;
}

In 7.0.3
.EventsViewer .default .event {
font-family:Consolas, Monaco, Courier New, monospace;
font-size:12px;
margin:0px 0px 0px 0px;
zoom:1;
white-space: pre;
}

I assume Inconsolata or Splunk Platform Mono is the new font you see. There is a similar difference in default.css (which maybe gets built from EventsViewer.css??). This doesn't address the cell padding.

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...