Splunk 6 - Customize Search App Views

[lguinn2]

In Splunk 5, it was possible to customize the two basic views in the Search App: flashtimeline and dashboard_live.
These views still exist in Splunk 6, but the Search App does not use them. Instead, the default search is listed in the URI as .../app/search/search, but search.xml is just a shell - there is no content there.

How can I customize the default Splunk 6 search views to

1 - set a different time range default (Last 24 hours) instead of All Time?
[Answer to question 1 is here: How to set the default search time in Splunk 6?]

2 - change how the Interesting Fields display? For example, in Splunk 5 you could exclude fields (like date_*) from appearing in the sidebar. I know about ui-prefs.conf, but it doesn't control whether specific fields appear.

[lmyrefelt]

You will find the answer in the ; Splunk web framework Toolkit . There is an example on how to create your on "splunk search" view , with the possibility of controlling the content, search, time, loading different css and js, etc etc

http://apps.splunk.com/app/1613/

[lguinn2]

Thanks for the pointer. And that is probably the answer, although I will need to research further.

It was just so much easier to change a few attributes in an XML file to do simple things like set default values. In Splunk 6, we can customize anything, but the cost may be that there is no simple way to set simple things.

[lmyrefelt]

Maybe some help here;

http://dev.splunk.com/view/SP-CAAAEU3

[lmyrefelt]

Hi, i believe the way to go is with a django template with the new web framework ?

However, it is possible, to put a new .html file into

share/splunk/search_mrsparkle/templates/pages/

And add whatever css, js and so to customize the "default" layout, view of search(if editing app.html)
If you add a new .html file into

share/splunk/search_mrsparkle/templates/pages/

Then you need to link to this file inside your xml code for "search" / whatever 🙂

[the_wolverine]

Spent way too much time trying to figure this out and have lost interest in trying to do this.

[lmyrefelt]

well, at least, please don't tell me we have totally lost that ability.

[lguinn2]

Nope, still looking for an answer... but haven't done any recent research

[the_wolverine]

You can modify the default.xml to use flashtimeline instead of search app:

Instead of using search in default.xml:

<nav search_view="search" color="#65A637">
  <view name="search" default='true' />
  <view name="data_models" />
  <view name="reports" />
  <view name="alerts" />
  <view name="dashboards" />
</nav>

Use (I just swapped flashtimeline in place of search) and added another line for dashboard_live.

<nav search_view="search" color="#65A637">
  <view name="flashtimeline" default='true' />
  <view name="dashboard_live" />
  <view name="data_models" />
  <view name="reports" />
  <view name="alerts" />
  <view name="dashboards" />
</nav>

[lguinn2]

Well, yes, but then you lose some of the functionality in the new search view...

[chris]

Hi Lisa did you ever find an answer to this question?

[fk319]

in 5, I could include a "index=unix" in the search bar automatically.