Installation Manual

How Splunk Web procedures have changed from version 5 to version 6

This topic lists some of the major differences in how to accomplish tasks using the Splunk Web user interface from version 5.x to version 6.2.

What's changed?

Procedure/Task	How you used to do it	How you do it now
First time login to Splunk Enterprise	In 5.x, the Splunk Enterprise launcher has two tabs: Welcome and Splunk Home. In Welcome, you can Add data and Launch search app.	In 6.2, Splunk Enterprise launches with Home. The main parts of Home include the Splunk Enterprise navigation bar, the Apps panel, the Explore Splunk Enterprise panel, and a custom default dashboard (not shown here).
Returning to Home	In 5.x, to return to Home/Welcome you selected the Home app from the App menu.	In 6.2, you click the Splunk logo in the upper left of the navigation bar. Doing so always returns you to Home.
Edit account information	In 5.x you accessed your account information (change full name, email address, default app, timezone, password) under Manager > Users and authentication > Your account.	In 6.2, you access account information directly from the Splunk navigation under Administrator > Edit Account.
Logout from Splunk Enterprise	In 5.x, you clicked the "Logout" button on the navigation bar.	In 6.2, you select Administrator > Logout. (If you are not logged in as Administrator, Splunk Enterprise displays the full name of the logged in user. Click this name to bring up the "Logout" menu option)
Manager/Settings	In 5.x, you edited all objects and system configurations from the Manager page or from the "Administrator" link on the navigation bar.	In 6.2, you access these configurations directly from the Settings menu. There is no separate Manager page.
Manage Apps: Edit permissions for installed apps, create a new app, or browse Splunk Apps for community apps	In 5.x, you used Manager -> Apps or selected from the App menu.	In 6.2, you use the Apps menu on the navigation bar or the gear icon beside the word Apps on the Home page.
Search	Summary, Search Searches & Reports Dashboards & Views	Search Reports Dashboards
Extract fields or show source	In the search results, click on the arrow to the left of the timestamp of an event and select Extract Fields or Show Source.	In the search results, click on the arrow to the left of the timestamp of an event and then click Event Actions. Select Extract Fields or Show Source.
Find the list of alerts	In the navigation bar, you selected "Alerts".	In the navigation bar, you select Activity > Triggered Alerts.
Find the timeline	In 5.x, the timeline was always visible as part of the dashboard after you ran a search. You can hide the timeline.	In 6.2, you can only view the timeline if you're looking at the Events tab after you run a search.