About sanjai

sanjai · ‎04-21-2026

Hi Everyone, I did some further testing to isolate why some strings translate and others don't. It seems the issue is tag-specific. The Test: I created a clean dashboard using the exact same strings in different tags. The Result: SUCCESS: Strings inside <title>, <label>, and <description> translate perfectly into German. FAILURE: The exact same strings inside <h3>, <ul>, or <li> tags (within an <html> block) stay in English. The Code I used for testing: <dashboard version="1.1"> <label>i18n String Verification</label> <description>XXXX is a product for monitoring XXXXX application usage and performance.</description> <row> <panel> <title>Top 10 users with most actions</title> <html> <p>Panel content here...</p> </html> </panel> <panel> <title>Top 10 machines with most actions</title> </panel> </row> <row> <panel> <title>Top 10 users with most actions</title> </panel> <panel> <title>Top 10 machines with most actions</title> </panel> </row> <row> <panel> <html> <h2>Testing Dashboard Labels:</h2> <ul> <li><strong>Label 1:</strong> Top 10 users with most actions</li> <li><strong>Label 2:</strong> Top 10 machines with most actions</li> <li><strong>Label 3:</strong> Captured actions by type</li> <li><strong>Label 4:</strong> Discarded actions by type</li> <li><strong>Label 5:</strong> Captured actions timeline</li> <li><strong>Label 6:</strong> Top 25 most time-consuming UI actions (by UI value)</li> </ul> </html> <html> <h3>Top 10 users with most actions</h3> <h3>Top 10 machines with most actions</h3> <h3>Captured actions by type</h3> <h3>Captured actions by type</h3> <h3>Top 25 most time-consuming UI actions (by UI value)</h3> <h3>Captured actions timeline</h3> <h3>Discarded actions by type</h3> </html> </panel> </row> </dashboard> What this confirms: My .mo and .po files are correctly compiled and located, otherwise the <title> wouldn't work. It seems Splunk 10.0.2’s translation engine ignores text nested inside <html> tags in Simple XML. Since my real app relies heavily on custom HTML and JavaScript, how can I force Splunk to include these HTML-wrapped strings in the i18n catalog? Is there a way to make the server-side parser scan inside <html> blocks? I'm not sure if I'm missing a simple setting or if this requires a more complex workaround. I’d appreciate any insights or thoughts you might have on why these specific tags are being skipped. Thanks, Sanjai Sankar

richgalloway · ‎11-20-2025

Timestamps issues are uncommon in _internal. Splunkd.log will show indexer restarts. Restarting does not clear the health status. That usually takes 24 hours. Use btool to view the default index settings. $SPLUNK_HOME/bin/splunk btool indexes _internal | grep "system\/default" Btool also can show overrides of default settings.

sanjai · ‎11-09-2025

I had a dashboard with multiple dropdowns (index, process_id, machine, location, department) and a time picker. The process_id and machine inputs used dynamic earliest/latest tokens, while the others had static time ranges. When restoring tokens via the “Apply Previous Filter” (APF) feature, all inputs were applied simultaneously. Because of that, machine and process_id were repopulated before index and time were ready — causing them to reset to default. To fix this, I added a sequential delay logic in JavaScript so filters apply in the correct order: 1. Index and Time range are restored first. 2. After ~800 ms, location and department are applied. 3. After ~1600 ms total, Process_id and machine are restored. Now, all filters load correctly in sequence. (No workaround was found from the Splunk XML side)

sanjai · ‎06-16-2025

Appreciate the insight@livehybrid — that helps! I’ll be doing a bit more investigation on my end too. if anyone has any other suggesstions , let me know..😊

sanjai · ‎05-30-2025

Hi @AsmaF2025 , I was able to resolve my jQuery issue by re-running the scan. You can check out the replies in this Reddit post — they were quite helpful: https://www.reddit.com/r/Splunk/comments/1g8ijdg/splunk_jquery_upgrade_to_35

sanjai · ‎04-27-2025

Hi @livehybrid , Yes, I do have the appIcon.png in the folder $SPLUNK_HOME/etc/apps/search/appserver/static/, but the error still appears. I’m also facing the same issue in my custom Splunk app located at $SPLUNK_HOME/etc/apps/Custom_app/appserver/static/. I tried adding the appIcon.png (36x36) there as well, restarted Splunk, and checked my custom app,(Also in all splunk apps) but the appIcon error still persists — even in the dashboards of core Splunk app

livehybrid · ‎02-28-2025

Hi @sanjai I believe you are on to the right thing here with `collections/shared/TimeZones` If you have a look at /opt/splunk/share/splunk/search_mrsparkle/exposed/js/views/shared/preferences/global/GlobalSettingsContainer.jsx it references the same file, and this is the file which renders the user preferences and displays the Time zone dropdown. Have a look at including that file (collections/shared/TimeZones.js) , or maybe copying it in to your app for the purposes of testing. My paths are Linux based by the way, so might need updating for your environment. Good luck! Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped. Regards Will

sanjai · ‎02-12-2025

Hi there, I finally found the solution! To hide the Splunk bar in the React app, you just need to pass some parameters. In my case, I added them in index.jsx (where I render all my components), and it worked for me: { hideChrome: true, pageTitle: "Splunk React app", theme, hideSplunkBar: true }

inventsekar · ‎09-03-2024

Hi @sanjai Regarding the app packaging, pls check the link provided above and pls update us if any other questions, thanks. Best Regards Sekar

LukeMurphey · ‎08-23-2024

I have done many Splunk React apps (Enterprise Security, Mission Control, etc.). In my experience, the easiest way is to embed your React code in an app. One of the clearest ways to do this is to follow the instructions provided in the Splunk UI library. It can be somewhat daunting at first to use Splunk UI and it's build scripting, but so many things will just work once you have your React code packaged in app. Authentication won't be an issue at all for you anymore and you can easily call Splunk endpoints and they will just work.

PickleRick · ‎08-19-2024

I'm not sure what you want here. You must have the server's address to connect to its API endpoint so it's not clear for me who would return that address to you. And you can't get user's password. It won't work that way. Also - what do you mean by "currently logged in user"? Which user? Are you trying to piggyback on someone's already existing session (if so, I'd expect Splunk to have defenses against session hijacking and if possible, that should probably be explicitly configured)? Or do you want to authenticate a user in Splunk so that you can use that session for your purposes? If so, use user's credentials to log in to Splunk, obtain a session token and use that token. But it has all the risks of a man-in-the-middle solution.

sanjai · ‎08-08-2024

Thanks @richgalloway and @isoutamo for your time , it worked 🙂🙌

sanjai · ‎06-30-2024

Hi @Rakeshar4u , I've included a link to the dashboard in the body of the alert email, but it appears as plain text rather than a clickable hyperlink. I also tried using <href>, but it still shows as plain text. Here's my alert configuration: My Splunk version is 9.2.1. Any insights would be appreciated.

sanjai · ‎06-27-2024

Hi @ITWhisperer , not really

sanjai · ‎06-26-2024

Hi @frobinson_splun , I have the same requirement to provide link to one of the tabs in a dashboard within an alert email. The tab name is dynamic. I noticed that the mentioned documentation links are expired. Could you please provide me with the latest documentation links? Thanks in advance.

sanjai · ‎06-26-2024

Hi @ajitshukla61116 My requirement is similar to yours: I need to include a link to a dashboard within an alert email. Have you made any progress on this use case? If so, your insights would be really helpful. Thanks in advance.

sanjai · ‎06-23-2024

Thanks @gcusello

burwell · ‎06-21-2024

What I tend to do to get all the results in email or Slack is to use stats as described here https://community.splunk.com/t5/Reporting/Using-result-fieldname-in-email-text-body-splunk-email-alert/m-p/399711

richgalloway · ‎06-15-2024

The parameters are documented in the Admin Manual and in $SPLUNK_HOME/etc/system/README/savedsearches.conf.spec. Splunk's JavaScript SDK is documented at dev.splunk.com

sanjai · ‎05-12-2024

Big thanks to you, @ITWhisperer ,The solution works flawlessly, and I'm particularly impressed by the elegant utilization of the foreach command. It perfectly aligns with our exact requirements. Thanks for the guidance and assistance .

sanjai · ‎05-09-2024

Thanks for the reply @deepakc , but that didn't work for me🙂

sanjai · ‎04-25-2024

Thanks @ITWhisperer , it worked

ITWhisperer · ‎04-22-2024

Also, see answers in this duplicate post https://community.splunk.com/t5/Dashboards-Visualizations/Passing-Token-values-to-Overlay-field-in-the-line-chart/m-p/684940#M56075

sanjai · ‎03-27-2024

Thank you @bowesmana . I'm also considering implementing the select value in JavaScript 🙂. Appreciate your time.

sanjai · ‎03-19-2024

Yes, I'm customizing the login screen for Splunk Enterprise, not for Splunk Cloud. I'm ignoring these failures. Thanks. @richgalloway

Posts	49
Solutions	2
Karma Given	18
Karma Received	3
Member Since	‎12-14-2023

Online Status	Offline
Date Last Visited	a month ago

i18n Issue: Custom App translations "flicker" and ...

High Percentage of Small Buckets on Indexer – Most...

Problem with “Apply Previous Filter” tokens resett...

User Status Detection in Splunk React App with LDA...

404 Error When Loading Dashboard – appLogo.png Not...

How to Retrieve Timezones List in Splunk React App

jQuery Upgrade Issue - Need Guidance

Packaging a React App as a Splunk App

Hiding Splunk Header Bar in React App

Using Session Credentials in a Splunk React App

Re: i18n Issue: Custom App translations "flicker" ...

Re: High Percentage of Small Buckets on Indexer – ...

Re: Problem with “Apply Previous Filter” tokens re...

Re: User Status Detection in Splunk React App with...

Re: jQuery Upgrade Issue - Need Guidance

Re: 404 Error When Loading Dashboard – appLogo.png...

Re: How to Retrieve Timezones List in Splunk React...

Re: Hiding Splunk Header Bar in React App

Re: Packaging a React App as a Splunk App

Re: Using Session Credentials in a Splunk React Ap...

Re: Making REST API URL and Credentials Dynamic in...

Re: Restore Admin Roles in Splunk After Accidental...

Re: Create link in an alert

Re: How to Include a Dashboard Tab Link in Alert E...

Re: Can we customize the message in the alert?

Re: How can we add " View dashboard in Splunk" as...

Re: How to Comment a Single Line in SPL Query?

Re: Alerting Email Single result

Re: Need Documentations Links

Re: Converting Multivalue Fields to Single Value F...

Re: Need Guidance on Formatting SPL Output for Ind...

Re: Passing Token values to Overlay field in the l...

Re: Passing token to chart overlay

Re: is it possible to create a text input with som...

Re: Splunk app inpsect - Customizing splunk login ...

Join the Conversation