Since Splunk has a webserver how can I have it serve alternate HTML pages? I'd like to provide some simple instructions (and a few other things) to my users and don't really feel like standing up another webserver since I am already running one with Splunk. What directory do I drop files into to have Splunk serve them?
Files in $SPLUNK_HOME/etc/system/static are served by splunkd at https://localhost:8089/static.
Files in $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed are served by the appserver at http://localhost:8000/static.
The file at:
$SPLUNK_HOME/etc/apps/yourapp/appserver/static/yourfile.html
should be accessible via:
http://splunk/static/app/yourapp/yourfile.html
http://splunk/en-US/static/@12345.67:0/app/yourapp/yourfile.html
As best practice, try to use relative paths if you can, since Splunk will generate dynamic URLs that look more like the second version above. The first version works under 4.2.1, but not sure about older versions.
Or, if you want to do something within a view/dashboard, you may also want to look at the ServerSideInclude
module in the Advanced XML.
Files in $SPLUNK_HOME/etc/system/static are served by splunkd at https://localhost:8089/static.
Files in $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed are served by the appserver at http://localhost:8000/static.