Developing Dashboards, Views, and Apps for Splunk Web

 


Embed Splunk dashboard elements in third party software

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Embed Splunk dashboard elements in third party software

Take any chart or graph created by Splunk and embed it in another web application.

NOTE: Anybody with access to the page can get the user credential by viewing the page source.

Enable insecure login

First, enable insecure login via web.conf by adding the following stanza:

[settings]
enable_insecure_login = true
...

Then, you must restart Splunk.

If you're unfamiliar with how Splunk configuration files work, read the Admin manual topic about configuration files.

Example of launching a search

You always first need to hit the /account/insecurelogin endpoint, sending in the parameters for username and password. The ultimate destination is sent in as a URL encoded argument in the return_to parameter.

http://splunkserver:8000/account/insecurelogin?username=admin&password=changeme&return_to=%2Fapp%2Fsearch%2Fflashtimeline?q=search%2520test


Create your view in Splunk

Next create a view XML that contains the element you want to embed in your third party app (eg a graph or chart). This view cannot use the simplified XML but must be written in advanced XML.

example view

Here's an example view from $SPLUNK_HOME/etc/apps/my_test_app/local/data/ui/views/my_view.xml:

<view template="dashboard.html">
  <module name="HiddenSearch" autoRun="True" layoutPanel="panel_row1_col1">
    <param name="search">sourcetype=access_common | timechart span=5m count</param>
    <param name="earliest">-24h</param>
    <module name="HiddenChartFormatter">
      <param name="chart">line</param>
      <param name="primaryAxisTitle.text">Time</param>
      <param name="legend.placement">bottom</param>
      <param name="chartTitle">Stuff past 24 hours</param>
      <module name="JobProgressIndicator"/>
      <module name="FlashChart"/>
    </module>
  </module>
</view>

Refresh your view when you make changes to it by loading this URI:

https://splunkserver.com:8089/servicesNS/myuser/search/data/ui/views?refresh=1

It is not necessary to refresh as the same user, just any valid user in <myuser>.

Create an iframe in your site

Finally, iframe that view into your third party app, via the /insecurelogin endpoint:

http://splunkserver:8000/account/insecurelogin?username=admin&password=changeme&return_to=/app/my_test_app/myview

Remember that the value of the “return_to” parameter must be URI-escaped (http://meyerweb.com/eric/tools/dencoder/ ). The resulting HTML page will render that view within the iframe element.

example HTML

Here's an example of adding an iframe into html:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
  "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Splunk Stuff</title>
</head>
<body>
<!-- content starts here -->

<h1>Hey Look At My Pretty Pictures!</h1>

<iframe src ="http://splunkserver:8000/account/insecurelogin?username=test_user&password=changeme&return_to=%2Fapp%2Fmy_test_app%2Fmy_view" width="100%" height="300">
  <p>Your browser does not support iframes.</p>
</iframe>

<!-- content ends here -->
</body>
</html>

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!