Dashboards & Visualizations

Looking for a simple (emphasis on "simple") way to revert to v5 UI functionality on a v6 installation.

grijhwani
Motivator

I REALLY do not like the new v6 UI. It is too kludgy. Too much time-wasting back and forth.

  • I don't like the fact that the general navigation bar is always off the top of the window and that I have to deliberately scroll back to reveal it every time I want to use it.

  • I don't like the fact that the menu buttons no longer lead to interactive drop-downs.

  • I don't like the fact that to select a report in full search mode I have to go to the reports page, run the report, then expressly RE-open it in search.

  • The fonts are bigger and styling now uses more space, meaning that too is wasteful of screen estate and adds to the manual scrolling overhead.

  • Next/prev (in search) only at the top of the page not the bottom which means scrolling back to the top to scroll through result pages. - OK, not so bad because the bar floats down the page during scrolling

The ideal solution would be to retrofit the complete v5 UI as far as possible across the board. Is there a nice simple way of doing this without having to dig manually into the XML?

Tags (3)
0 Karma
1 Solution

grijhwani
Motivator

Well it seems a partial answer is to simply move the v6 default search app aside (i.e. move the ~splunk/etc/apps/search directory to a different name, and replace it with a copy of same from v5. That brings back all the downs, and gets rid of the clunky flip-between-pages-to-select-a-report nonsense. It remains to be seen whether the report-maintenance side of things will handle the UI change or just get thoroughly confused. And it also doesn't change the fact that running a report from the search app requires to then explicitly re-open it in the search dialogue to get the search parameters visible again (which again is a clunky, unnecesssary step).

So far everything I have seen of the changes to v6 are in user interaction, and they are at best "unhelpful". Sorry to say I am REALLY unimpressed. Certainly won't be upgrading the work platform past v5.0.5 for the forseeable future.

View solution in original post

grijhwani
Motivator

Bump. Wondering if - a year later - anyone has had any real success retro-fitting the v5 UI onto v6? I really loathe the v6 unfriendliness (or over-friendliness, depending on your design ethos).

0 Karma

grijhwani
Motivator

Well it seems a partial answer is to simply move the v6 default search app aside (i.e. move the ~splunk/etc/apps/search directory to a different name, and replace it with a copy of same from v5. That brings back all the downs, and gets rid of the clunky flip-between-pages-to-select-a-report nonsense. It remains to be seen whether the report-maintenance side of things will handle the UI change or just get thoroughly confused. And it also doesn't change the fact that running a report from the search app requires to then explicitly re-open it in the search dialogue to get the search parameters visible again (which again is a clunky, unnecesssary step).

So far everything I have seen of the changes to v6 are in user interaction, and they are at best "unhelpful". Sorry to say I am REALLY unimpressed. Certainly won't be upgrading the work platform past v5.0.5 for the forseeable future.

grijhwani
Motivator

And change the default start-up to jump straight into the search app:
change ~splunk/etc/users/admin/user-prefs/local# cat user-prefs.conf
[general]
default_namespace = search
...

0 Karma

grijhwani
Motivator

I have also found that it requires digging into the CSS to revert fonts to more efficient and recognisable defaults.

Here's a start:
/opt/splunk/share/splunk/search_mrsparkle/exposed/css/bootstrap.min.css
:%s/"Roboto",//g
:%s/"Droid",//g
:%s/"Helvetica Neue",//g

/opt/splunk/share/splunk/search_mrsparkle/exposed/css/pages/search-bootstrap.min.css
:%s/'Droid Sans Mono',//g
:%s/Consolas,//g
:%s/Monaco,//g
:%s/"Droid Sans Mono",//g
:%s/"Consolas",//g
:%s/"Monaco",//g

0 Karma

dglinder
Path Finder

Taking the "emphasis on simple" comment, how about installing a second copy of v5.0 on the same server but in a different directory and listening on a different port? It can use your existing indexers and the load from having it sit idle as you start to use the version 6 console will be negligible.

This assumes you and your users aren't making use of the version 6 code yet within your apps.

0 Karma

grijhwani
Motivator

Probably quite correct. Historically Splunk's distributed search has always been backward compatible with the prior version of indexer, but because of technology/protocol changes new indexers are quite often not backward-compatible with the older version of distributed search.

This is why my standard upgrade sequence is always search head first, followed by non-critical indexer(s), and finally the critical indexers, making sure any wrinkles are ironed out at each step before moving to the next.

0 Karma

joebensimo
Path Finder

According to the documentation, and direction I got from Splunk support when I inquired, a v5 search instance won't work with v6 indexers. Have you found mixing search and indexer versions like this to work?

0 Karma

grijhwani
Motivator

I'm not, but I AM using Splunk Free at home as my first testbed for migrating to v6 on Enterprise at work, and once I upgrade the indexers there I don't want to have to hold the search head back. And the impression of v6 is nippy but clunky interaction.

I want a way of fixing the UI ahead of time, so I don't get earfuls of complaints, not holding the search head back (which is the simplest option). If I don't like it the end users not going to like it any better.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...