I recently followed this document to customize the event display for my own eventtype : http://www.splunk.com/base/Documentation/4.1.5/Developer/EventRendering
It's quite interesting and useful, but I found the "highlight effect" of search keyword would be malfunctioned in my customized display. I know I should put some special code in my template to creat this effect, but I don't know how....
Any tips or reference ?
Leo Wang
Have a look here:
http://answers.splunk.com/questions/4937/custom-event-renderer
I had the same problem. If you exactly know how your event looks like and you have a predefined set of fields you can try putting this aroung your fields:
SOME_VALUE_HERE
Thanks for your response. but it seems not working in my case. My simple event-rendering template is like this , which just use the field value to display my event data.
<%page args="job, event, request, options" />
<% mydate = event.fields.get('date','') %>
<% mycase = event.fields.get('CaseDetail','No example') %>
<% mydetail = event.fields.get('detail','none') %>
<span id="eventTypeForm"/>
<table border=1>
<tr><td> <b>Date:</b> ${mydate|h}<br/> </td> <td> <b>Rule :</b>${myrule|h}<br/> </td> </tr>
<tr><td colspan=2> ${mydetail} </td> </tr>
</table>
</div>
enter code here
Have you specified/defined the appropriate CSS class?
Looks to me like you would need to define a highlight color for the matched terms class, such as:
.myEventRendererClass .a {
background-color: #F5E998;
}