Splunk Search

Custom event renderers in Splunk 6

gsteff
Explorer

Can anyone confirm that custom event renderers still work as documented in Splunk 6? I've tried going through the CSS and HTML customization steps (though not JS) described here several times, and can't get anything to behave as described. In particular, no elements appear in the DOM inspector with the expected splEvent-foo class, but some elements (the rendered "time" column) do appear with a bare foo event, which, again, is not what the documentation says will be generated.

I've also tried copying over the etc/search/defaults/event_renderers.conf file to etc/search/local/event_renderers.conf to enable the custom event renderers that appear to be builtin to the search app, but they don't appear to be invoked either.

Has anyone gotten custom event rendering to work in 6.0.1?

Tags (2)

mdessus_splunk
Splunk Employee
Splunk Employee

Hello,
you can:

  • select an event hit the "Event actions" button
  • select "Build Event type"
  • do whatever to build your eventtype...
  • select one color in the style while saving it

This will populate your event_renderers.conf file.

Go back to search, and in the event view, the background of the rectangle containing the arrow (left to the event) will be colored with the specified color.

0 Karma

rroberts
Splunk Employee
Splunk Employee

Looks like the only way to edit the color is by command line edit of event_renderers.conf.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...