Splunk® Enterprise

Installation Manual

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Changes for Splunk App developers

If you develop apps for Splunk, read this topic to find out what changes we've made to how Splunk works with apps in version 6.0, and how to migrate any existing apps to work with the new version.

We have removed support for FlashCharts in simple XML dashboards

We no longer support using FlashCharts in simple XML dashboards. This change provides a more consistent dashboard user experience for iOS devices and when users need to create PDFs. When users upgrade to version 6 of Splunk:

  • Splunk will silently ignore any charting options that previously triggered the rendering of FlashCharts.
  • No actionable requirement here, but note that Splunk might render some charts differently in version 6.0 as a result.

We no longer support viewstates in simple XML

We have removed Splunk's capability to support view states in simple XML. This means that, when users upgrade:

  • Any chart options that were saved in viewstates will no longer be layered in dashboard rendering.
  • Users will need to manually migrate these chart options to the simple XML view configuration.
  • In addition, dynamic chart resizing no longer persists beyond the page view.
  • Users that are interested in persistence should save this in simple XML (<option name=height>300px</option>)

We no longer allow Splunk's Search page to be restyled

The new Search page in Splunk 6.0 can no longer be customized, as it does not load any custom JavaScript or CSS.

We have added restrictions to how you can style the AppBar

For consistency between apps, Splunk 6.0 now constrains AppBar customization to:

To set a color in the AppBar, edit the navigation menu default.xml (for example, <nav color="#0072C6">).
If no logo file is found, the app name is displayed instead.

We have made changes to support for custom JavaScript and CSS

Version 6 of Splunk gets a refactored rendering engine, and as a result, many of the function calls that the application.js and application.css files use no longer work after users upgrade.

  • For app backward compatibility, in Splunk 6, simple XML dashboards no longer load application.js and application.css automatically.
  • Instead, simple XML dashboards in Splunk 6 load dashboard.js and dashboard.css automatically.
  • You can control the loading of specific JavaScript and CSS files within the configuration of each simple XML dashboard. You control this using the top-level attributes (<dashboard script=my_script.js stylesheet=my_stylesheet.css>).
  • This design approach allows you to use application.js and application.css for previous versions of Splunk, as well as dashboard.js and dashboard.css for Splunk 6.0 and later.

For security purposes, we now prohibit JavaScript within the default.xml file for dashboard navigation menus

We no longer allow JavaScript to run in a dashboard's navigation menu. This means that, when users upgrade:

  • Any app that has packaged the "Create dashboard..." link within their navigation menu (like the old search app) will find this to no longer work in Splunk 6.0.
  • You should remove this from your default.xml configuration.

Splunk now has a new "search" view page

Splunk 6.0 introduces a new search page "search" as a replacement to the existing Flash timeline. While the product still contains Flash timeline, you should change all references to flashtimeline within an app to "search" instead.

  • This includes references within navigation menu's default.xml.
  • It also includes references within any dashboard views (mainly for linkView options).

We have made new global pages available to add to your app

Splunk 6.0 provides easier access to reports, alerts, dashboards, and data models packaged within your app. We provide this access through via new listing pages for each of these objects (dashboards, reports, alerts, data_models).

  • To add these views, edit your navigation menu's default.xml.

We have added the ability to run search queries from the Home page for your app

Splunk 6.0 enables end-users to run a search query from within the Home page, and target specific apps. You can allow end-users to directly target your app by configuring your app's navigation menu default.xml.

To do this, edit default.xml and add the target view (<nav search_view="search">).

We have introduced "Data Models"

Splunk 6.0 introduces data models that you can package within your apps. To add data models to your apps, package them within $SPLUNK_HOME/etc/apps/<app_name>/default/data/models

We have made changes to how Splunk works with custom HTML dashboards

Splunk 6.0 has added knowledge objects to be included in default.meta, and now supports dashboard views written entirely in HTML (by leveraging the new splunkjs library).

You can add custom HTML dashboards by packaging them within $SPLUNK_HOME/etc/apps/<app_name>/default/data/ui/html and referencing them in default.meta with the object name [html].

We have added interval support for modular inputs

Prior to version 6, Splunk invoked any configured modular inputs when the Splunk daemon started. In version 6, splunkd now checks the inputs at specific intervals.

You can choose whether or not you want to refactor your script to use this interval support.

We have changed where Splunk looks for the icon files

In versions of Splunk prior to 6.0, Splunk looked in $SPLUNK_HOME/etc/apps/<your_app>/appserver/static. When users upgrade, Splunk then looks in $SPLUNK_HOME/etc/apps/<your_app>/static.

We now require higher-resolution application logos and icons

In order to support displays with pixel density ratio of greater than 1:1 (as is the case for systems like the MacBook Pro with Retina Display), you must now use higher resolution icons and/or logos alongside the standard size icons and logos.

  • The file names for these higher-resolution icons and logos must be appLogo_2x.png and appIcon_2x.png.
  • When packaging your application icons and logos, put them in $SPLUNK_HOME/etc/apps/<app_name>/static.
  • Your application logo has the following additional specifications:
    • The background must be transparent.
    • Its width can vary, but:
    • Its height, with margins, must be no more than 40 pixels (80 pixels for the high resolution version).
    • Within this 40-pixel limit, there must be a margin of at least 10 pixels on the top and bottom sides (20 pixels for the high resolution version) which leaves a maximum of 20 pixels of height available for your logo.
    • There is, however, some leeway to go into the margin area, particularly if the logo has any bits that stick up or down or it's particularly complex, square or round.



How Splunk Web procedures have changed from version 5 to version 6
Upgrade to 6.0 on UNIX

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters