- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk 6 - Customize Search App Views
![lguinn2 lguinn2](https://community.splunk.com/legacyfs/online/avatars/109473.jpg)
In Splunk 5, it was possible to customize the two basic views in the Search App: flashtimeline
and dashboard_live
.
These views still exist in Splunk 6, but the Search App does not use them. Instead, the default search is listed in the URI as .../app/search/search
, but search.xml
is just a shell - there is no content there.
How can I customize the default Splunk 6 search views to
1 - set a different time range default (Last 24 hours) instead of All Time?
[Answer to question 1 is here: How to set the default search time in Splunk 6?]
2 - change how the Interesting Fields display? For example, in Splunk 5 you could exclude fields (like date_*
) from appearing in the sidebar. I know about ui-prefs.conf
, but it doesn't control whether specific fields appear.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You will find the answer in the ; Splunk web framework Toolkit . There is an example on how to create your on "splunk search" view , with the possibility of controlling the content, search, time, loading different css and js, etc etc
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![lguinn2 lguinn2](https://community.splunk.com/legacyfs/online/avatars/109473.jpg)
Thanks for the pointer. And that is probably the answer, although I will need to research further.
It was just so much easier to change a few attributes in an XML file to do simple things like set default values. In Splunk 6, we can customize anything, but the cost may be that there is no simple way to set simple things.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Maybe some help here;
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, i believe the way to go is with a django template with the new web framework ?
However, it is possible, to put a new .html file into
share/splunk/search_mrsparkle/templates/pages/
And add whatever css, js and so to customize the "default" layout, view of search(if editing app.html)
If you add a new .html file into
share/splunk/search_mrsparkle/templates/pages/
Then you need to link to this file inside your xml code for "search" / whatever 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![the_wolverine the_wolverine](https://community.splunk.com/legacyfs/online/avatars/55.jpg)
Spent way too much time trying to figure this out and have lost interest in trying to do this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
well, at least, please don't tell me we have totally lost that ability.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![lguinn2 lguinn2](https://community.splunk.com/legacyfs/online/avatars/109473.jpg)
Nope, still looking for an answer... but haven't done any recent research
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![the_wolverine the_wolverine](https://community.splunk.com/legacyfs/online/avatars/55.jpg)
You can modify the default.xml to use flashtimeline instead of search app:
Instead of using search in default.xml:
<nav search_view="search" color="#65A637">
<view name="search" default='true' />
<view name="data_models" />
<view name="reports" />
<view name="alerts" />
<view name="dashboards" />
</nav>
Use (I just swapped flashtimeline in place of search) and added another line for dashboard_live.
<nav search_view="search" color="#65A637">
<view name="flashtimeline" default='true' />
<view name="dashboard_live" />
<view name="data_models" />
<view name="reports" />
<view name="alerts" />
<view name="dashboards" />
</nav>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![lguinn2 lguinn2](https://community.splunk.com/legacyfs/online/avatars/109473.jpg)
Well, yes, but then you lose some of the functionality in the new search view...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Lisa did you ever find an answer to this question?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![fk319 fk319](https://community.splunk.com/legacyfs/online/avatars/1467.jpg)
in 5, I could include a "index=unix" in the search bar automatically.
![](/skins/images/396DDBEEAC295EB5FEC41FF128E8AC0A/responsive_peak/images/icon_anonymous_message.png)