Changes for Splunk App developers
If you develop apps for Splunk, read this topic to find out what changes we've made to how Splunk works with apps in version 6.0, and how to migrate any existing apps to work with the new version.
We have removed support for FlashCharts in simple XML dashboards
We no longer support using FlashCharts in simple XML dashboards. This change provides a more consistent dashboard user experience for iOS devices and when users need to create PDFs. When users upgrade to version 6 of Splunk:
- Splunk will silently ignore any charting options that previously triggered the rendering of FlashCharts.
- No actionable requirement here, but note that Splunk might render some charts differently in version 6.0 as a result.
We no longer support viewstates in simple XML
We have removed Splunk's capability to support view states in simple XML. This means that, when users upgrade:
- Any chart options that were saved in viewstates will no longer be layered in dashboard rendering.
- Users will need to manually migrate these chart options to the simple XML view configuration.
- In addition, dynamic chart resizing no longer persists beyond the page view.
- Users that are interested in persistence should save this in simple XML (<option name=height>300px</option>)
We no longer allow Splunk's Search page to be restyled
We have added restrictions to how you can style the AppBar
For consistency between apps, Splunk 6.0 now constrains AppBar customization to:
- To set a color in the AppBar, edit the navigation menu
- If no logo file is found, the app name is displayed instead.
Version 6 of Splunk gets a refactored rendering engine, and as a result, many of the function calls that the
application.css files use no longer work after users upgrade.
- For app backward compatibility, in Splunk 6, simple XML dashboards no longer load
- Instead, simple XML dashboards in Splunk 6 load
<dashboard script=my_script.js stylesheet=my_stylesheet.css>).
- This design approach allows you to use
application.cssfor previous versions of Splunk, as well as
dashboard.cssfor Splunk 6.0 and later.
- Any app that has packaged the "Create dashboard..." link within their navigation menu (like the old search app) will find this to no longer work in Splunk 6.0.
- You should remove this from your
Splunk now has a new "search" view page
Splunk 6.0 introduces a new search page "search" as a replacement to the existing Flash timeline. While the product still contains Flash timeline, you should change all references to flashtimeline within an app to "search" instead.
- This includes references within navigation menu's
- It also includes references within any dashboard views (mainly for
We have made new global pages available to add to your app
Splunk 6.0 provides easier access to reports, alerts, dashboards, and data models packaged within your app. We provide this access through via new listing pages for each of these objects (dashboards, reports, alerts, data_models).
- To add these views, edit your navigation menu's
We have added the ability to run search queries from the Home page for your app
Splunk 6.0 enables end-users to run a search query from within the Home page, and target specific apps. You can allow end-users to directly target your app by configuring your app's navigation menu
To do this, edit
default.xml and add the target view (
We have introduced "Data Models"
Splunk 6.0 introduces data models that you can package within your apps. To add data models to your apps, package them within
We have made changes to how Splunk works with custom HTML dashboards
Splunk 6.0 has added knowledge objects to be included in
default.meta, and now supports dashboard views written entirely in HTML (by leveraging the new
You can add custom HTML dashboards by packaging them within
$SPLUNK_HOME/etc/apps/<app_name>/default/data/ui/html and referencing them in
default.meta with the object name
We have added interval support for modular inputs
Prior to version 6, Splunk invoked any configured modular inputs when the Splunk daemon started. In version 6,
splunkd now checks the inputs at specific intervals.
You can choose whether or not you want to refactor your script to use this interval support.
We have changed where Splunk looks for the icon files
In versions of Splunk prior to 6.0, Splunk looked in
$SPLUNK_HOME/etc/apps/<your_app>/appserver/static. When users upgrade, Splunk then looks in
We now require higher-resolution application logos and icons
In order to support displays with pixel density ratio of greater than 1:1 (as is the case for systems like the MacBook Pro with Retina Display), you must now use higher resolution icons and/or logos alongside the standard size icons and logos.
- The file names for these higher-resolution icons and logos must be
- When packaging your application icons and logos, put them in
- Your application logo has the following additional specifications:
- The background must be transparent.
- Its width can vary, but:
- Its height, with margins, must be no more than 40 pixels (80 pixels for the high resolution version).
- Within this 40-pixel limit, there must be a margin of at least 10 pixels on the top and bottom sides (20 pixels for the high resolution version) which leaves a maximum of 20 pixels of height available for your logo.
- There is, however, some leeway to go into the margin area, particularly if the logo has any bits that stick up or down or it's particularly complex, square or round.
How Splunk Web procedures have changed from version 5 to version 6
Upgrade to 6.0 on UNIX
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15