Custom event renderers in Splunk 6

[gsteff]

Can anyone confirm that custom event renderers still work as documented in Splunk 6? I've tried going through the CSS and HTML customization steps (though not JS) described here several times, and can't get anything to behave as described. In particular, no elements appear in the DOM inspector with the expected splEvent-foo class, but some elements (the rendered "time" column) do appear with a bare foo event, which, again, is not what the documentation says will be generated.

I've also tried copying over the etc/search/defaults/event_renderers.conf file to etc/search/local/event_renderers.conf to enable the custom event renderers that appear to be builtin to the search app, but they don't appear to be invoked either.

Has anyone gotten custom event rendering to work in 6.0.1?

[mdessus_splunk]

Hello,
you can:

• select an event hit the "Event actions" button
• select "Build Event type"
• do whatever to build your eventtype...
• select one color in the style while saving it

This will populate your event_renderers.conf file.

Go back to search, and in the event view, the background of the rectangle containing the arrow (left to the event) will be colored with the specified color.

[rroberts]

Looks like the only way to edit the color is by command line edit of event_renderers.conf.