Splunk Search

Custom event renderers in Splunk 6

gsteff
Explorer

Can anyone confirm that custom event renderers still work as documented in Splunk 6? I've tried going through the CSS and HTML customization steps (though not JS) described here several times, and can't get anything to behave as described. In particular, no elements appear in the DOM inspector with the expected splEvent-foo class, but some elements (the rendered "time" column) do appear with a bare foo event, which, again, is not what the documentation says will be generated.

I've also tried copying over the etc/search/defaults/event_renderers.conf file to etc/search/local/event_renderers.conf to enable the custom event renderers that appear to be builtin to the search app, but they don't appear to be invoked either.

Has anyone gotten custom event rendering to work in 6.0.1?

Tags (2)

mdessus_splunk
Splunk Employee
Splunk Employee

Hello,
you can:

  • select an event hit the "Event actions" button
  • select "Build Event type"
  • do whatever to build your eventtype...
  • select one color in the style while saving it

This will populate your event_renderers.conf file.

Go back to search, and in the event view, the background of the rectangle containing the arrow (left to the event) will be colored with the specified color.

0 Karma

rroberts
Splunk Employee
Splunk Employee

Looks like the only way to edit the color is by command line edit of event_renderers.conf.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...