Splunk Dev

How do you change the user interface in Enterprise version? (Legal Aspects)

smartekav
Explorer

Hi Guys,

I may sound stupid, but since I am new here wanted to know if Enterprise License of Splunk allows us to change the UI (look and feel)?

Thanks

Tags (1)
0 Karma
1 Solution

acharlieh
Influencer

This question is a complex one, but the difficult part is more the navigation of the legal aspects more so than the actual technical implementation aspects. Before diving too deep on this, I think it's best that we level set a bit:

  1. I am not a lawyer, nor am I employed by Splunk Inc. advice below is strictly from my own experiences
  2. While there are general terms of types of Splunk licenses that often have common mechanics, these are negotiated contracts between Splunk and your organization, and specific terms can and do in fact vary from company to company

In General, an Enterprise license is typically strictly for the use of an individual organization's Internal Business Purposes only. Furthermore, the organization is usually prohibited from reselling functionality, or creating derivative works for clients.

Now you mention that you are needing to make UI changes for clients, if you are a Value Added Reseller, and working on their Splunk for having Splunk power websites for their internal business purposes that's likely OK. If these changes are their Splunk and showing data to their clients, well that gets into a very grey area, You need to be careful that you are not doing anything that could be construed as directly sublicensing Splunk's software. Giving clients' customers' access to the Search interface, probably no bueno. Having Splunk email a regular report of processing being done on behalf of a client, that you would be gathering data in Splunk to then compile and send out reports anyways... maybe ok, so long as it's not a primary feature being sold... embedding splunk functionality into custom webpages for third party consumption. very grey area.

In terms of customizations that are available under an enterprise license, there is a full gambit up including a Web Framework for building dashboards and views for apps in anything from basic Splunk branding to full blown HTML, JavaScript, and CSS, so much customizability that you could power quite a bit without leaving the Splunk app itself. web.conf has some basic rebranding tooling as well. Scheduled Reports can be embedded into third party sites. Furthermore Splunk has a full powered REST API where you can run searches and pull results into all kinds of other applications.

But in all of those you are to be obeying the restrictions in terms of your user population.

Now that said about Enterprise licenses, I want to also make you aware of two other license types, one is an Original Equipment Manufacturer (OEM) license, and the other being a Managed Service Provider (MSP) license. Unlike the Enterprise license, these licenses are for when you are providing Splunk technology for use by your customers' employees, as opposed to just for your own employees. The difference between OEM and MSP is that OEM Splunk is typically where you are selling a white labeled product or service and all ingestion and searching is done specifically for that particular service (as spelled out in the OEM Agreement). Unless specifically spelled out you likely wouldn't be downloading Splunkbase apps and shipping those, as you are required to white label the product. Splunk's OEM team actually has an OEM Toolkit and other resources for rebranding Splunk pretty much from the ground up that they make available to OEM Partners.

MSP Splunk is where you're running and managing Splunk technology on behalf of third parties for their business purposes. Here your customers are buying Splunk so you don't have the sourcetype restrictions that you do under the OEM license, but you may or may not have the freedom to white label the product. (I haven't seen one of these agreements)

Hopefully that was helpful and mostly coherent, for a late night rambling. Again, consult with your organization's legal team and your contracts as far as what would or would not be permitted under your current agreements with Splunk (or your customer's organizations' agreements if you're working on their Splunk installations as a contractor). The technology to rebrand Splunk is available, it's just who you enable and how you use it that could get you into trouble. (You would not want Lenny to be eating your face )

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Are you going to resell splunk within your application / device?

If so, you need OEM agreement with Splunk to repackage it as part of your product / service.

You can learn more here:
https://www.splunk.com/en_us/partners/become-a-partner.html

0 Karma

niketn
Legend

@smartekav if your requirement is to apply your Enterprise Stylesheet to Splunk Dashboard you would need to apply the same to dashboard.css and save the same under your Splunk App's appserver/static folder which is typically $SPLUNK_HOME/etc/apps/<yourSplunkApp>/appserver/static. Changes to dashboard.css apply to all dashboards within the app.

However, the CSS style might not apply directly and you might have to configure them as overrides to existing Bootstrap/Splunk App/visualization specific CSS. So, you would need to create CSS overrides based on CSS styles not getting picked up as expected, using your Internet Browser's Inspector Tool. Which would imply Web Developer would need to spend time with understanding Splunk's CSS selector and your Enterprise CSS and create final CSS accordingly. An example Custom Layout Dark is present in Splunk Dashboard Examples app

Refer to one of my old answer for various approaches for applying CSS Style to Splunk Dashboards: https://answers.splunk.com/answers/590387/how-do-i-update-panel-color-in-splunk-using-css-1.html

Also refer to Splunk Documentation for Login UI customization and applying CSS to Dashboards: http://docs.splunk.com/Documentation/SplunkCloud/latest/AdvancedDev/CustomizationOptions

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

smartekav
Explorer

Thanks @niketnilay for the answer, but is it legal to do so in Enterprise version? or we have to figure it out with Splunk team while purchasing license ?

DalJeanis
SplunkTrust
SplunkTrust

@smartekav - There's no reason not to discuss it with your Splunk representative. You need to make sure to get the right license for your intended use. Upvote for asking the question, which shows you are ethical and trying to get it right.

smartekav
Explorer

Thanks @DalJeanis , just wanted to clear things before actual work.

@niketnilay : Thanks, you answer definitely helps, but I have accepted @acharlieh answer as I was looking more towards the legal aspect of this. Might be I didn't ask question in a proper and meaningful way, but again thanks for your answer.

DalJeanis
SplunkTrust
SplunkTrust

@smartekav - Your question was just fine. That answer was excellent, so of course @acharlieh deserved the karma. If you found @niketnilay's answer or comments helpful -- or anyone else's, for that matter -- then please feel free to upvote them as well.

Do be aware that there is an OEM sales group as well as the regular end client sales group, so if you are planning to build something and sell it to multiple clients, then you may need to discuss it with the other group instead. Also, if you have an edge case, it's up to you guys to negotiate which contract to start with and modify to get your exact needs met. We have a pretty wide ecosystem at this point, so the answer for a lot of things, technical, contractual, or otherwise, is "It depends".

Best Wishes.

acharlieh
Influencer

Building out a custom app with custom UI is usually fine under an Enterprise license. Customizing Splunk shipped apps this way may limit the types of support you get on those apps but isn't typically inherently against the license. If the changes are being done to enable the reselling of Splunk functionality to third parties (as opposed to just streamlining and advancing the Enterprise Licensee's Internal Business Purposes) that's where you may run afoul of your license, but again you should consult the specific terms of your specific Enterprise License as they are negotiated contracts and especially with larger volumes custom terms may be present

smartekav
Explorer

Thanks @acharlieh for your answer, I think that clears my confusion.

0 Karma

acharlieh
Influencer

This question is a complex one, but the difficult part is more the navigation of the legal aspects more so than the actual technical implementation aspects. Before diving too deep on this, I think it's best that we level set a bit:

  1. I am not a lawyer, nor am I employed by Splunk Inc. advice below is strictly from my own experiences
  2. While there are general terms of types of Splunk licenses that often have common mechanics, these are negotiated contracts between Splunk and your organization, and specific terms can and do in fact vary from company to company

In General, an Enterprise license is typically strictly for the use of an individual organization's Internal Business Purposes only. Furthermore, the organization is usually prohibited from reselling functionality, or creating derivative works for clients.

Now you mention that you are needing to make UI changes for clients, if you are a Value Added Reseller, and working on their Splunk for having Splunk power websites for their internal business purposes that's likely OK. If these changes are their Splunk and showing data to their clients, well that gets into a very grey area, You need to be careful that you are not doing anything that could be construed as directly sublicensing Splunk's software. Giving clients' customers' access to the Search interface, probably no bueno. Having Splunk email a regular report of processing being done on behalf of a client, that you would be gathering data in Splunk to then compile and send out reports anyways... maybe ok, so long as it's not a primary feature being sold... embedding splunk functionality into custom webpages for third party consumption. very grey area.

In terms of customizations that are available under an enterprise license, there is a full gambit up including a Web Framework for building dashboards and views for apps in anything from basic Splunk branding to full blown HTML, JavaScript, and CSS, so much customizability that you could power quite a bit without leaving the Splunk app itself. web.conf has some basic rebranding tooling as well. Scheduled Reports can be embedded into third party sites. Furthermore Splunk has a full powered REST API where you can run searches and pull results into all kinds of other applications.

But in all of those you are to be obeying the restrictions in terms of your user population.

Now that said about Enterprise licenses, I want to also make you aware of two other license types, one is an Original Equipment Manufacturer (OEM) license, and the other being a Managed Service Provider (MSP) license. Unlike the Enterprise license, these licenses are for when you are providing Splunk technology for use by your customers' employees, as opposed to just for your own employees. The difference between OEM and MSP is that OEM Splunk is typically where you are selling a white labeled product or service and all ingestion and searching is done specifically for that particular service (as spelled out in the OEM Agreement). Unless specifically spelled out you likely wouldn't be downloading Splunkbase apps and shipping those, as you are required to white label the product. Splunk's OEM team actually has an OEM Toolkit and other resources for rebranding Splunk pretty much from the ground up that they make available to OEM Partners.

MSP Splunk is where you're running and managing Splunk technology on behalf of third parties for their business purposes. Here your customers are buying Splunk so you don't have the sourcetype restrictions that you do under the OEM license, but you may or may not have the freedom to white label the product. (I haven't seen one of these agreements)

Hopefully that was helpful and mostly coherent, for a late night rambling. Again, consult with your organization's legal team and your contracts as far as what would or would not be permitted under your current agreements with Splunk (or your customer's organizations' agreements if you're working on their Splunk installations as a contractor). The technology to rebrand Splunk is available, it's just who you enable and how you use it that could get you into trouble. (You would not want Lenny to be eating your face )

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @smartekav,

Thanks for posting. Could you give us some more context for your query? What exactly are you trying to change? You have a much better chance of getting your question answered if you provide more information about your issue. Plus, it will help guide future community users who are facing a similar problem.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What aspects of the UI do you want to change?

---
If this reply helps you, Karma would be appreciated.
0 Karma

smartekav
Explorer

Normally the requirement is we have to come up with some dashboards and then show them as per the existing design of the client's website. Means the header line should be changed so that we can accommodate client's logo and change the color, also left hand side bar should be changed which will have icons having links to different dashboards.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@smartekav,

It depends! 🙂 There are few configuration changes you could make to change login screen,dashboard icon etc. What exactly do you want to change?

Happy Splunking!
0 Karma

smartekav
Explorer

Normally the requirement is we have to come up with some dashboards and then show them as per the existing design of the client's website. Means the header line should be changed so that we can accommodate client's logo and change the color, also left hand side bar should be changed which will have icons having links to different dashboards.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Splunk Dashboard Examples might be a good start for you.

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...