Splunk Search

Custom event renderers in Splunk 6

gsteff
Explorer

Can anyone confirm that custom event renderers still work as documented in Splunk 6? I've tried going through the CSS and HTML customization steps (though not JS) described here several times, and can't get anything to behave as described. In particular, no elements appear in the DOM inspector with the expected splEvent-foo class, but some elements (the rendered "time" column) do appear with a bare foo event, which, again, is not what the documentation says will be generated.

I've also tried copying over the etc/search/defaults/event_renderers.conf file to etc/search/local/event_renderers.conf to enable the custom event renderers that appear to be builtin to the search app, but they don't appear to be invoked either.

Has anyone gotten custom event rendering to work in 6.0.1?

Tags (2)

mdessus_splunk
Splunk Employee
Splunk Employee

Hello,
you can:

  • select an event hit the "Event actions" button
  • select "Build Event type"
  • do whatever to build your eventtype...
  • select one color in the style while saving it

This will populate your event_renderers.conf file.

Go back to search, and in the event view, the background of the rectangle containing the arrow (left to the event) will be colored with the specified color.

0 Karma

rroberts
Splunk Employee
Splunk Employee

Looks like the only way to edit the color is by command line edit of event_renderers.conf.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...