This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.0 , 3.0.1 , 3.0.2 , 3.1 , 3.1.1 , 3.1.2 , 3.1.3 , 3.1.4
The default interface is defined by the HTML, CSS, JavaScript and XSL found under the $SPLUNK_HOME/share/splunk/search_oxiclean directory. Each skin has a CSS file that overrides the default styles, particularly for color properties and images.
Note The directory $SPLUNK_HOME/share/splunk/search_pinesol contains old UI files. They no longer work with the 3.0 UI, do not make changes in this directory.
$SPLUNK_HOME/share/splunk/search_oxiclean/static/css/skins
The .css files in this directory are where most customizations are done. Files placed here will appear in the Themes menu in SplunkWeb. Since any file is assumed to be a skin, don't forget to remove temporary files created by your text editor. The standard skins provided are basic.css, the default theme, and black.css, the all-black "inverted" or "night mode" theme. You can use either of these files as a base to design your own themes.
$SPLUNK_HOME/share/splunk/search_oxiclean/images/skins
This is the standard location for image files, one directory for each skin. You can use the default images in your new skins by specifying their path from $SPLUNK_HOME/share/splunk/search (like "background-image:url(/images/skins/basic/menu_arrow_bg.gif".) Any new images should go in a new directory to avoid confusing them with the default ones.
This directory contains the standard styles that control the appearance of the interface. You can override default properties by adding individual elements to your custom skin CSS file with the new styles.
The text strings presented to the user in SplunkWeb are defined in literals.conf The full list can be found in $SPLUNK_HOME/etc/bundles/default/literals.conf. Strings are organized in stanzas, like other Splunk conf files, and can be put in a custom bundle. Be sure to use the correct stanza name for the strings you wish to change, some stanzas have a large number of items.
Warning Do not alter or remove any format strings (like "%s") that are used to display a variable. Splunk will still attempt to pass the argument, if it is missing, you will see a Python stack trace with the message "exceptions.TypeError: not all arguments converted during string formatting". Also, incorrect HTML (like mismatched or missing tags) may generate an exception.
If you make any changes including non-ascii characters, use an editor that can save the files as UTF-8. Restart the web interface ("splunk restart splunkweb") for changes to take effect.
[ui-admin-section-labels-/admin/users]
name = Username
``realName = Nom et prénoms``
``userType = Rôle``
[ui]
FILE_ALREADY_UPLOADED_MESSAGE = Splunk is already loading a file named %s. Please wait for it to finish, then try uploading this file again.