Splunk .conf material

For those of you attending my talk, “Building Effective Charts in Splunk” at the 2011 Splunk User Conference, here are the supporting materials:


Download the self-contained Prezi file:


Also try out the Splunk Particle app at: http://metasplunk.com/projects/particle

Custom CSS Demo App

Download this tgz file and untar into:


Restart, and point your browser to:


Download the app: http://dl.dropbox.com/u/1748015/userconf_demo.tgz

The userconf_demo.tgz app contains 3 variations of the same view in different stages of customization:

internal_overview_stock.xml: this is the base view with no CSS or charting customizations.  It removes the standard chrome by omitting modules like the AccountBar and AppBar.

internal_overview_partial.xml: this is the stock view with CSS applied to it.  The CSS rules are defined in the newsprint.css file.

internal_overview.xml: this is the partial view with chart properties set.

All 3 views use the _internal index so most Splunk instances will have some data appear.

Posted by



Splunk .conf material

Show All Tags
Show Less Tags

Join the Discussion