Developing Dashboards, Views, and Apps for Splunk Web

 


Embed Splunk dashboard elements in third party software

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Embed Splunk dashboard elements in third party software

Take any chart or graph created by Splunk and embed it in another web application. Currently, Splunk does not have single sign-on implemented, so you will have to use an insecure login to authenticate against Splunk.

CAUTION: Anybody with access to the page can get the user credential by viewing the page source.

Enable insecure login

First, enable insecure login via web.conf by adding the following stanza:

[settings]
enable_insecure_login = true
...

Then, you must restart Splunk.

If you're unfamiliar with how Splunk configuration files work, read the Admin manual topic about configuration files.

Create your view in Splunk

Next create a view XML that contains the element you want to embed in your third party app (for example, a graph or chart). The view should contain only the modules you want to display in your portal, so you'll want to strip out any of the Splunk chrome. This view cannot use the simple XML; it must be written in advanced XML. Save your view in $SPLUNK_HOME/etc/apps/<app_name>/local/data/ui/views/<view_name>.xml

example view

Here's an example view that has all the Splunk chrome stripped out. This view just shows a chart driven by a hidden search.

<view template="dashboard.html">
  <module name="HiddenSearch" autoRun="True" layoutPanel="panel_row1_col1">
    <param name="search">sourcetype=access_common | timechart span=5m count</param>
    <param name="earliest">-24h</param>
    <module name="HiddenChartFormatter">
      <param name="chart">line</param>
      <param name="primaryAxisTitle.text">Time</param>
      <param name="legend.placement">bottom</param>
      <param name="chartTitle">Stuff past 24 hours</param>
      <module name="JobProgressIndicator"/>
      <module name="FlashChart"/>
    </module>
  </module>
</view>

Refresh your view when you make changes to it by loading this URI:

https://localhost:8089/servicesNS/<user_name>/<app_name>/data/ui/views?refresh=1

Note: Replace host and port with your host and management port.

Create an iframe in your site

Finally, iframe the view you've created into your third party app, via the /insecurelogin endpoint:

http://splunkserver:8000/account/insecurelogin?username=admin&password=changeme&return_to=/app/foo/myview

Remember that the value of the “return_to” parameter must be URI-escaped. Also, replace username and password with the username and password you'd like to use. The resulting HTML page will render that view within the iframe element.

example HTML

Here's an example of adding an iframe into HTML:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
  "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Splunk Stuff</title>
</head>
<body>
<!-- content starts here -->

<h1>Hey Look At My Pretty Pictures!</h1>

<iframe src ="http://myhost:8000/account/insecurelogin?username=test_user&password=changeme&return_to=%2Fapp%2Fmy_test_app%2Fmy_view" width="100%" height="300">
  <p>Your browser does not support iframes.</p>
</iframe>

<!-- content ends here -->
</body>
</html>

This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!