How to customize my own event display but keep the "highlight effect" ?

[leo_wang]

I recently followed this document to customize the event display for my own eventtype : http://www.splunk.com/base/Documentation/4.1.5/Developer/EventRendering

It's quite interesting and useful, but I found the "highlight effect" of search keyword would be malfunctioned in my customized display. I know I should put some special code in my template to creat this effect, but I don't know how....

Any tips or reference ?

Leo Wang

[wollinet]

Have a look here:

http://answers.splunk.com/questions/4937/custom-event-renderer

I had the same problem. If you exactly know how your event looks like and you have a predefined set of fields you can try putting this aroung your fields:

SOME_VALUE_HERE

[leo_wang]

Thanks for your response. but it seems not working in my case. My simple event-rendering template is like this , which just use the field value to display my event data.

<%page args="job, event, request, options" />
<% mydate = event.fields.get('date','') %>
<% mycase = event.fields.get('CaseDetail','No example') %> 
<% mydetail = event.fields.get('detail','none') %>
  <span id="eventTypeForm"/>
     <table border=1>
        <tr><td> <b>Date:</b> ${mydate|h}<br/> </td> <td>  <b>Rule :</b>${myrule|h}<br/> </td> </tr>
         <tr><td colspan=2> ${mydetail} </td> </tr>
     </table>

</div>

enter code here

[gkanapathy]

Have you specified/defined the appropriate CSS class?

[gkanapathy]

Looks to me like you would need to define a highlight color for the matched terms class, such as:

.myEventRendererClass .a {
  background-color: #F5E998;
}