Advanced view building

Advanced view building

Splunk's App framework has a built-in and customizable presentation layer, complete with a library of components. Every page in Splunk Web is custom built. These pages, or views, are XML files stored in an App's view directory. Views are made out of a library of modules. Every module is actually a directory of CSS, JavaScript, HTML and, in some cases, Python and Flash.

Views can be modified to fit your specifications. Or, you can create your own views from scratch. Here's a general outline of the basic concepts for configuring views:

1. Decide which modules you want to include in your view.
2. Configure each module in <view_name>.xml.
3. Put <view_name>.xml in the views directory, inside your app directory: $SPLUNK_HOME/etc/apps/<App_name>/data/ui/views/
4. If you have more than one view for your App, arrange them in the UI by following the instructions in Create view collections.
5. To change the CSS for a view, Change your app's style.

Note: If you're customizing your App by modifying the xml outside of Splunk Manager, you can reload the configs by navigating to the following.

Get a brand new app to show up:

https://<splunkserver>:<splunkmgmtport>/services/apps/local?refresh=true 

Reload a specific app:

https://<splunkserver>:<splunkmgmtport>/services/apps/local/<appname>?refresh=true 

Reload all views:

http://<splunkserver>:<splunkwebport>/app/<appname>/

Types of views

There are three main types of views: dashboards, form searches and search views. Each type of view is defined by a Mako template, located in $SPLUNK_HOME/share/splunk/search_mrsparkle/templates/view/. Mako templates are HTML files with support for Python. Splunk's templates define page layout; basically, how each element fits into a page.

Dashboards

• Build a dashboard
  • Dashboards are useful for presenting visual summaries of various searches.
  • Learn more about dashboards here.

Form searches

• Build a form search
  • Form searches let you restrict the search interface to present one or more search boxes with more complex searches running behind the scenes.
  • There's more information here.

Search views

• Build a search view
  • Search views are pages that let you run a search and interact with search results.
  • Learn more about how to build a search view here.

More Splunk Web customizations

Customize your App's look and feel. Here are a few things you can do:

• Change the menu layout.
• Add your own custom HTML and JavaScript.
• Skin your App with custom CSS.

Learn more about what you can do here.

Types of modules

There are a number of modules from which you can build your view. For example, the search bar within a page is one module. Modules also include graphs and charts, text entry boxes, links, drop-down menus and other components. For a general overview of how modules work, read How modules work.

Modules live in $SPLUNK_HOME/share/splunk/search_mrsparkle/modules/. For a complete list, see the Module reference. Or, append ?showsource=true to any view's URL to see the hierarchy of modules in the page. For example:

http://localhost:8000/en-US/app/search/charting?showsource=true

Note: Replace localhost:8000 with your installation host and port.