Splunk 4.3 showing flash

[kml_uvce]

I upgraded Splunk version 4.2.4 to Splunk 4.3 in linux (using .rpm file) but in my IPAD it looks like the graphs are still in flash not showing html 5. I am using mac laptop and IPad.
Can you please help me on this ?

[dmaislin_splunk · Accepted solution]

If you have access to the back end and it's a Linux box you can go to the $SPLUNK_HOME directory, then go into the app you have difficulty with Flash and make a change with SED too, i.e.

/opt/splunk/etc/apps/{APPNAME]/default/data/ui/views]

Once there:

find . -type f -exec sed -i 's/FlashChart/JSChart/g' {} \;

Restart Splunk.

[sideview]

As another example, some of the more advanced charting keys and custom charting configurations are only supported by FlashChart, not JSChart....

[sideview]

Note that it's quite possible to damage functionality in the app if you were to do this. Certainly if you did it to an app that used FlashChart, and that app used Sideview Utils, you'd probably break something. Sideview Utils patches and extends functionality in FlashChart, but the same patches and extensions are not applied to JSChart, so such a change would probably break all drilldowns there. (as a side note on the side note, the new Sideview Development Kit does patch the JSChart so you might be safe doing this there).

[dmaislin_splunk]

Go to the app. Then go to Manager, User interface, Views, and edit the view. If it is advanced XML you will see lots of XML and in one of the module titles you should see the FlashChart XML statement. Change that to JSChart. Save the Changes.

If it is simple XML and you don't see that FlashChart option, then you have to turn it into advanced XML. Go back to the App. Then, at the end of the URL string, add $showsource=1

This will show you the advanced XML if you scroll way down the page and copy the entire contents of the XML in the window. Go back to the Manager, User interface, Views, and edit the simple XML view. There you replace everything and paste in the advanced XML and also make the edit of FlashChart to JSChart. Save the changes.

I wrote this to maximize editing in the UI. You can also make all these changes in the shell if you know where to look, but that's another conversation.

[jodros]

Would this be pertinent to the search app for advanced charting? When I try to view advanced charting on an iOS device, I get prompted to install flash. I am running 4.3.1 and this is advanced charting within the core Splunk search app.

Thanks

[dmaislin_splunk]

No. What app are you in?

[kml_uvce]

In my view there is a module

[dmaislin_splunk]

If the app was written with advanced XML views, the module most likely has Flashchart in the XML. Try going into the XML view and chage it to JSChart.

[kml_uvce]

How I can do this? can you please tell me the steps ?