Overlay search results on a background image

[bbthesplunk]

My company leverages background images to describe our security architecture around inbound email and on quarterly basis we overlay the results of each layer on the image for distribution. This looks like something Splunk could do, since all the data currently resides in Splunk and is accessible through searches. So my question is..

Is it possible to overlay search results on a custom image inside of Splunk? If so, can you point me in the right direction?

Thanks

[sdaniels · Accepted solution]

This is certainly possible to do in Splunk and much easier now that Splunk 6 has been released since you can just use native HTML. You"ll see an example in the Splunk 6 Dashboard Examples app. (Layout Elements -> Image Overlay With Single Values)

http://apps.splunk.com/app/1603/?elq=9bb5463a0c9047bd87a56326391ce0e8&elqCampaignId=911

From Nick:

Splunk 6 makes this a lot easier to do within Simple XML, where you can include custom css on a per-page level

The basics are as such:
- Create all of your dashboard elements that you want to overlay in simple xml (set an "id" for each element; new to Splunk 6)
- Use row grouping for the above so that a single "panel" gets rendered
- Include a custom css in your simple xml view
- Use css to set absolute positions for each element (by id)