Security

Where is the CSS file to edit to revert the SplunkWeb UI to the font used before v7.1?

orion44
Communicator

Can you point me to the CSS file to edit to revert the SplunkWeb UI to the font used before v7.1?

Personally, I think the new font is hard to read. It also introduces an extra 8 pixels of spacing for each line at 125% zoom, which is a colossal waste of space.

Before / After images attached for illustration.

shamanov_i
Explorer

I've found sort of workaround for this problem.

We can delete new font files from $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/fonts and keep only Splunk*, droid* and roboto* font files. Splunk will use this fonts after next restart, but in Messages we'll be seeing notification about file modifications.

To remove this notification we can remove lines with deleted font files from *manifest file in your $SPLUNK_HOME folder.

New interface with old fonts:
alt text

dheera
New Member

I did the same and now see following files:

roboto-regular-webfont.woff
roboto-bold-webfont.woff
SplunkIcons.glyphs
droid-sans-mono-webfont.woff
roboto-light-webfont.woff

But still I see same fonts.

Can you please help?

0 Karma

shamanov_i
Explorer

You can clear browser cache and try open Splunk web interface again.

0 Karma

shamanov_i
Explorer

Also, new Splunk UI font doesn't support cyrillic characters and because of that text with cyrillic and latin symbols or with numbers looks disgusting.

ehughes100
Explorer

I haven't tested changing this yet, but ..... In EventsViewer.css I see the following change:
In 7.1
.EventsViewer .default .event {
font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace;
font-size:12px;
margin:0px 0px 0px 0px;
zoom:1;
white-space: pre;
}

In 7.0.3
.EventsViewer .default .event {
font-family:Consolas, Monaco, Courier New, monospace;
font-size:12px;
margin:0px 0px 0px 0px;
zoom:1;
white-space: pre;
}

I assume Inconsolata or Splunk Platform Mono is the new font you see. There is a similar difference in default.css (which maybe gets built from EventsViewer.css??). This doesn't address the cell padding.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...