This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.0 , 3.0.1 , 3.0.2 , 3.1 , 3.1.1 , 3.1.2 , 3.1.3 , 3.1.4
The SplunkWeb user interface can be modified to accomplish rebranding and color changes.
The default interface is defined by the HTML, CSS, JavaScript and XSL found under the $SPLUNK_HOME/share/splunk/search_oxiclean directory. Each skin has a CSS file that overrides many default style settings, particularly for color properties and images.
$SPLUNK_HOME/share/splunk/search_oxiclean/static/css/skins
The .css files in this directory are where most customizations are done. Files placed here will appear in the Themes drop-down of the Preferences menu in SplunkWeb. Since any file is assumed to be a skin, don't forget to remove temporary files created by your text editor. The standard skins provided are basic.css, the default theme, and black.css, the all-black "inverted" or "night mode" theme. You can use either of these files as a base to design your own themes.
$SPLUNK_HOME/share/splunk/search_oxiclean/images/skins
This is the standard location for image files, one directory for each skin. You can use the default images in your new skins by specifying their path from $SPLUNK_HOME/share/splunk/search_oxiclean (like "background-image:url(/images/skins/basic/menu_arrow_bg.gif".) Any new images should go in a new directory to avoid confusing them with the default ones.
This directory contains the standard styles that control the appearance of the interface. You can override default properties by adding individual elements to your custom skin CSS file with the new styles.