Security

How do I get Splunk to serve other content

matt
Splunk Employee
Splunk Employee

Since Splunk has a webserver how can I have it serve alternate HTML pages? I'd like to provide some simple instructions (and a few other things) to my users and don't really feel like standing up another webserver since I am already running one with Splunk. What directory do I drop files into to have Splunk serve them?

Tags (1)
0 Karma
1 Solution

ewoo
Splunk Employee
Splunk Employee

Files in $SPLUNK_HOME/etc/system/static are served by splunkd at https://localhost:8089/static.

Files in $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed are served by the appserver at http://localhost:8000/static.

View solution in original post

southeringtonp
Motivator

The file at:

$SPLUNK_HOME/etc/apps/yourapp/appserver/static/yourfile.html

should be accessible via:

http://splunk/static/app/yourapp/yourfile.html
http://splunk/en-US/static/@12345.67:0/app/yourapp/yourfile.html

As best practice, try to use relative paths if you can, since Splunk will generate dynamic URLs that look more like the second version above. The first version works under 4.2.1, but not sure about older versions.

Or, if you want to do something within a view/dashboard, you may also want to look at the ServerSideInclude module in the Advanced XML.

ewoo
Splunk Employee
Splunk Employee

Files in $SPLUNK_HOME/etc/system/static are served by splunkd at https://localhost:8089/static.

Files in $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed are served by the appserver at http://localhost:8000/static.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...