I tried the below with the splunk instance in my machine, * Kept the js file inside "/appserver/static" folder of my application * launched the url http://127.0.0.1:800/en-US/static/app/MyApp/src/js/karthi.js?123456 * It opens the content of my screit * Now,I have modified my code and launched the url http://127.0.0.1:800/en-US/static/app/MyApp/src/js/karthi.js?**654321** * it opens the new content... * So you don't have to refresh or restart splunk.. Just have to change the url.. you can use Math.random() to do so.. E.G : http://127.0.0.1:800/en-US/static/app/MyApp/src/js/karthi.js? + Math.random() ... But in your case you should not hard code the JS file path in script tag... you should add the script tag dynamically and it to head tag...... E.g: jQuery('<script src="/static/app/MyApp/karthi.js?' +Math.random() + '"/>").appendTo("head"); ... View more

I have found a new solution for my requirement, in default.xml (etc/apps/myapp/default/data/ui/nav/defaults.xml) we can give the background color for our application's icon in the home page app list... as below... <nav color="#333333"> <view name="home" default="true" /> <view name="flashtimeline" /> </na> What splunk does is, it will apply the color as a style for that div.. as below... suffixed with a ';' <div style="background-color:#333333;"> so if we change the xml as below, <nav color="#333333;dislpay:none"> <view name="home" default="true" /> <view name="flashtimeline" /> </na> it will create a dive with below style <div style="background-color:#333333;dislpay:none;"> and my application id hidden in Splunk Home page ... View more

Inside C:\Program Files\Splunk\share\splunk\search_mrsparkle\exposed\js\build\splunkjs\mvc\tableview.js, the render method will be called only if canRender method returns true for that cell... if (cellRenderer instanceof BaseCellRenderer) { if (cellRenderer.canRender(cellData)) { cellRenderer.setup($td, cellData); cellRenderer.render($td, cellData); renderedCell.cellData = cellData; renderedCell.cellRenderer = cellRenderer; break; } So you have to identify the required cell in candRender too... But before investing time in that just return true from candRender method and see whether it work or not... ... View more

If you see the tableview.js inside C:\Program Files\Splunk\share\splunk\search_mrsparkle\exposed\js\build\splunkjs\mvc it will cal render only if the canRender returns true if (cellRenderer instanceof BaseCellRenderer) { if (**cellRenderer.canRender(cellData)**) { cellRenderer.setup($td, cellData); **cellRenderer.render($td, cellData);** renderedCell.cellData = cellData; renderedCell.cellRenderer = cellRenderer; break; } You must identify you column number in canRender too or just return true; from canRender... and check what is happening.......... ... View more

send me what you are getting a a value for cell Or Before sending that just try return true; ... View more

yes you can... to confirm that just put a console.log(tdposition + value) before that condition ... View more

require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(, $, mvc, TableView) { // Row Coloring Example with custom, client-side range interpretation var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { // Enable this custom cell renderer for both the active_hist_searches and the active_realtime_searches field return (['active_hist_searches', 'active_realtime_searches']).contains(cell.field); }, render: function($td, cell) { // Add a class to the cell based on the returned value var value = parseFloat(cell.value); // Apply interpretation for number of historical searches var tdPosition = $td.parent().children().index($td[0]); //To customize First Column based on its value if (tdPosition == 0) { if (value > 2) { $td.addClass('range-cell').addClass('range-severe'); } else if (value > 1) { $td.addClass('range-cell').addClass('range-elevated'); } else if (value > 0) { $td.addClass('range-cell').addClass('range-low'); } } // Apply interpretation for number of realtime searches //To customize Second Column based on its value if (tdPosition == 1) { if (value > 1) { $td.addClass('range-cell').addClass('range-severe'); } } // Update the cell content $td.text(value.toFixed(2)).addClass('numeric'); } }); mvc.Components.get('highlight').getVisualization(function(tableView) { // Add custom cell renderer tableView.table.addCellRenderer(new CustomRangeRenderer()); // tableView.on('rendered', function() { // Apply class of the cells to the parent row in order to color the whole row // tableView.$el.find('td.range-cell').each(function() { // $(this).addClass(this.className); // }); //}); // Force the table to re-render tableView.table.render(); }); }); ... View more

Instead, can you Please show me your results screen shot..... ... View more

I guess you will the same column number even if you have different field name.. If that is right...... Then you can get the column position and decide your color... $td.parent().children().index($td[0]) == coloumnPos Get the parent Element (i.e ) get the list of childrens (i.e. ss) find the position of the current td and compare it with your column position and do the rest with coloring.... Note : coloumn count starts from Zero ...i.e zero for 1st column ... View more

You can do it using splunk/etc/apps/MyApplication/appserver/static/application.js... if(Splunk.util.getCurrentView() == "yourViewName" && Splunk.Module.SimpleResultsTable){ Splunk.Module.SimpleResultsTable = $.klass(Splunk.Module.SimpleResultsTable, { onResultsRendered: function() { var container = this.container; . . . **Select and color your element using jQuery** . . . } }); } Above example is to customize SimpleResultsTable.... *container is the parent div element of your table view ... View more

I don't know whether this is the best way as it has some limitation... You can create a custom command and implement your logic to add/modify fields in you result.... This can be used not only to correlate your result with an another search's result...But also for the data from a external system.... i.e.. You can add or modify fields to the existing search results based on its value.... By Default You can process only 50000 results... see command.conf docs for more details.... Splunk have good doc to create custom command ... http://dev.splunk.com/view/python-sdk/SP-CAAAEU2 http://docs.splunk.com/Documentation/Splunk/6.2.3/Search/Writeasearchcommand ... View more

Yes... it gives you just the required data .. Just filter and customize it 🙂 ... View more

try this.. this lists saved searched /reports from all apps rest /servicesNS/-/-/saved/searches Yours may be stored in some other app ... View more

Please try this rest /servicesNS/-/ApplicationName/saved/searches ... View more

I am not aware of that. Is there any url to read what and how about SplunkSSO.. Please share it ... View more

Yes I agree... I thought the parent screen/App (i.e. the screen to which a splunk is going to be included) is having some authentication mechanism. So when you load the splunk page inside some page which is pre-authenticated .. You can implement your script to interact with that parent app for user validation... i.e : 1. Authenticate your user within your app 2. Load the splunk inside you app's iframe 3. Implement the splunk's script to interact with your app's REST or some http endpoint to vaidate the user. 4. Validate the user details in your app. (User name maybe a dynamic value stored inside the session of the app) 5. If it is valid proceed... or just leave it 🙂 ... View more

add an empty column to your table (using your search)... You can implement your logic to add custom drill down using javaScript/jQuery inside application.js ... View more

httP://....:8000/splunkApp/account/insecurelogin?username=USERNAME&password=PASSWD*return_to=%2Fdebug%2Frefresh return_to -> Page/view that should be displayed Above is the way to pass the userName and Password for a HTTP GET request in splunk. You have to enable enable_insecure_login option in web.conf refer Here You can simply pass a valid username/password to that url and load it in a iFrame. But that will expose the user name and password. So i suggest the above "External Authentication stuff"....... ... View more

Set up user authentication with external systems helps you to write your own authentication mechanism to splunk.. If you configured your authentication.conf for scripted authentication [authentication] authType = Scripted authSettings = script [script] scriptPath = $SPLUNK_HOME/bin/python $SPLUNK_HOME/bin/ Splunk will not use its own authentication mechanism. Instead it will interact with your python file to authenticate a user and roles. You must implement the following method in your python file... userLogin getUserInfo getUsers getSearchFilter Check this page for sample script creation : http://docs.splunk.com/Documentation/Splunk/6.2.2/Security/Createtheauthenticationscript ... View more

Check for the availability of the REST end point for those resources.. you can even execute queries... Refer the below link http://dev.splunk.com/restapi ... View more

Another option is there.... append an empty row to the end just with latitude and longitude value alone (before calling geostats) to know how to append empty row please see the below link http://answers.splunk.com/answers/41525/add-a-row-to-end-of-table.html ... View more

Sorry..... My suggestion on application.css won't work as it will be loaded only in dash boards ... View more

I don't know about the access level blocking of search bar.. but by changing the css.. you can hide it... Copy the below code to application.css (MyApp\appserver\static\application.css) of your application .search-bar{ display:none !important; } ... View more

Yes, You can.... 1.You have to implement a python script to give the user role/permission to splunk 2.Configure the splunk to ask that python file about the user details Now launch your url. Splunk will interact with that python method and user the user details returned Please refer the below link http://docs.splunk.com/Documentation/Splunk/6.2.2/Security/ConfigureSplunktousePAMorRADIUSauthentication ... View more

Yes... You are both @intelsubham and @richgalloway are correct.. I am getting zero results due to a custom command in my query. (Splunk docs.. says python custom command will returns only 50000 records.... and the last 50000 records are filtered by my query condition).. ... View more