Security

Where is the CSS file to edit to revert the SplunkWeb UI to the font used before v7.1?

orion44
Communicator

Can you point me to the CSS file to edit to revert the SplunkWeb UI to the font used before v7.1?

Personally, I think the new font is hard to read. It also introduces an extra 8 pixels of spacing for each line at 125% zoom, which is a colossal waste of space.

Before / After images attached for illustration.

shamanov_i
Explorer

I've found sort of workaround for this problem.

We can delete new font files from $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/fonts and keep only Splunk*, droid* and roboto* font files. Splunk will use this fonts after next restart, but in Messages we'll be seeing notification about file modifications.

To remove this notification we can remove lines with deleted font files from *manifest file in your $SPLUNK_HOME folder.

New interface with old fonts:
alt text

dheera
New Member

I did the same and now see following files:

roboto-regular-webfont.woff
roboto-bold-webfont.woff
SplunkIcons.glyphs
droid-sans-mono-webfont.woff
roboto-light-webfont.woff

But still I see same fonts.

Can you please help?

0 Karma

shamanov_i
Explorer

You can clear browser cache and try open Splunk web interface again.

0 Karma

shamanov_i
Explorer

Also, new Splunk UI font doesn't support cyrillic characters and because of that text with cyrillic and latin symbols or with numbers looks disgusting.

ehughes100
Explorer

I haven't tested changing this yet, but ..... In EventsViewer.css I see the following change:
In 7.1
.EventsViewer .default .event {
font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace;
font-size:12px;
margin:0px 0px 0px 0px;
zoom:1;
white-space: pre;
}

In 7.0.3
.EventsViewer .default .event {
font-family:Consolas, Monaco, Courier New, monospace;
font-size:12px;
margin:0px 0px 0px 0px;
zoom:1;
white-space: pre;
}

I assume Inconsolata or Splunk Platform Mono is the new font you see. There is a similar difference in default.css (which maybe gets built from EventsViewer.css??). This doesn't address the cell padding.

Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...