Download topic as PDF
This documentation does not apply to the most recent version of Splunk.
for the latest version.
How Splunk Web procedures have changed from version 5 to version 6
This topic lists some of the major differences in how to accomplish tasks using the Splunk Web user interface from version 5.x and version 6.0 and 6.1.
||How you used to do it
||How you do it now
|First time login to Splunk Enterprise
||In 5.x, the Splunk Enterprise launcher has two tabs: Welcome and Splunk Home. In Welcome, you can Add data and Launch search app.
||In 6.0 and 6.1, Splunk Enterprise launches with Home. In Home, you can access Apps directly, Add data, or access the Manage data page.
|Returning to Home
||In 5.x, to return to Home/Welcome you selected the Home app from the App menu.
|In 6.0 and 6.1, you click the Splunk logo in the upper left of the navigation bar. Doing so always returns you to Home.
|Edit account information
||In 5.x you accessed your account information (change full name, email address, default app, timezone, password) under Manager > Users and authentication > Your account.
|In 6.0 and 6.1, you access account information directly from the Splunk navigation under Administrator > Edit Account.
|Logout from Splunk Enterprise
||In 5.x, you clicked the "Logout" button on the navigation bar.
|In 6.0 and 6.1, you select Administrator > Logout. (If you are not logged in as Administrator, Splunk Enterprise displays the full name of the logged in user. Click this name to bring up the "Logout" menu option)
||In 5.x, you edited all objects and system configurations from the Manager page or from the "Administrator" link on the navigation bar.
|In 6.0 and 6.1, you access these configurations directly from the Settings menu. There is no separate Manager page.
|Manage Apps: Edit permissions for installed apps, create a new app, or browse Splunk Apps for community apps
||In 5.x, you used Manager -> Apps or selected from the App menu.
|In 6.0 and 6.1, you use the Apps menu on the navigation bar or the options under the Apps panel from Home.
Searches & Reports
Dashboards & Views
|Extract fields or show source
||In the search results, click on the arrow to the left of the timestamp of an event and select Extract Fields or Show Source.
|In the search results, click on the arrow to the left of the timestamp of an event and then click Event Actions. Select Extract Fields or Show Source.
|Find the list of alerts
||In the navigation bar, you selected "Alerts".
|In the navigation bar, you select Activity > Triggered Alerts.
|Find the timeline
||In 5.x, the timeline was always visible as part of the dashboard after you ran a search. You can hide the timeline.
|In 6.0 and 6.1, you can only view the timeline if you're looking at the Events tab after you run a search.
Last modified on 28 October, 2014
This documentation applies to the following versions of Splunk® Enterprise:
6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14