Splunk® Enterprise

Developing Views and Apps for Splunk Web

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

UI internationalization

If you want to internationalize the Splunk Web UI, you can localization tools to:

  • Translate text generated by Python code, JavaScript code, views, menus and Mako templates.
  • Set language/locale specific alternatives for static resources such as images, CSS, other media.
  • Create new languages or locales.
  • Format times, dates and other numerical strings.

When you log in to Splunk Enterprise, Splunk Web uses the language that your browser is set to. If you want to switch languages, change your browser settings.

Splunk Enterprise detects locale strings. A locale string contains two components: a language specifier and a localization specifier. This is usually presented as two lowercase letters and two uppercase letters linked by an underscore. For example, en_US means US English while en_GB means British English.

When looking for a suitable translation, Splunk Enterprise first tries to find an exact match for the whole locale, but falls back to just the language specifier if the entire setting is not available. For example, translations for fr answer to requests for fr_CA and fr_FR (French, Canada and France respectively). The user's locale also affects the formatting of dates, times, numbers, and other localized settings. Different countries have differing standards on how to format these entities.


Splunk Enterprise uses the gettext internationalization and localization system. When using gettext, you typically use an editor to create, generate, and edit the files used to localize strings in an application. Splunk recommends Poedit, a free, open source editor for localization.

To translate Splunk Enterprise, follow these directions:

1. Create a directory for the locale. For example, to create the fictional locale mz, create the following directory:


2. Load the following messages.pot file into your PO editor.


3. Use the PO editor to translate any strings you want to localize. Save the file as messages.po in the directory you created in step 2. The PO editor also saves a messages.mo file, which is the machine readable version of the PO file.

4. Restart Splunk. There are no other configuration files to edit. Splunk detects the new language files when it restarts.

Localization files

Splunk Enterprise stores localization information at the following location:

  • messages.pot: Holds the strings to translate. Use a PO editor to edit these files.
  • <locale_string>: The directory containing localization files for the locale specified by <locale_string> (for example, ja_JP).
  • <locale_string>/LC_MESSAGES/messages.po: Contains the source strings specified for localization in messages.pot. Using a PO editor, provide the translations for these strings.
  • <locale_string>/LC_MESSAGES/messages.mo: A machine readable version of messages.po that Splunk uses to find translated strings. The PO editor creates this for you when it creates the messages.po file.

Localize dates and numbers

You can format numbers and dates to the standards of a locale without having to translate any text. For this scenario, copy the contents of the en_US directory to the target locale directory.

For example, to enable localization of numbers and dates for the de_CH locale (German – Switzerland), copy the contents of the following directory:


and place them here:


Translate Apps

You can also use gettext to translate apps. However, most apps must be translated in their own locale subdirectory. Apps that ship with Splunk Enterprise are automatically extracted and their text included in the core messages.pot file. You do not need to handle them separately.

To extract the strings from an installed application, ready to be translated in a PO editor, run the following command from Splunk Enterprise command line:

splunk extract i18n -app <appname>

This creates a locale/ subdirectory in the app's root directory and populates it with a messages.pot file. Then, follow the steps above to translate the strings within the app. When using views from a different app, the new messages.pot file contains the strings for these views.

Locale-specific resources

Splunk Enterpise stores static resources such as images, CSS files, and other media as subdirectories at the following location:


When serving these resources, Splunk Enterprise checks to see whether a locale-specific version of the resource is available before falling back to the default resource. For example, if your locale is set to fr_FR, Splunk Enterprise searches for the logo image file in the following order:

  • exposed/img/skins/default/logo-mrsparkle-fr_FR.gif
  • exposed/img/skins/default/logo-mrsparkle-fr.gif
  • exposed/img/skins/default/logo-mrsparkle.gif

Splunk Enterprise follows the same path to load HTML templates (including any views) that define each page in the UI. This can be useful for languages that require a modified layout that CSS alone cannot accommodate (right to left text for example).

Last modified on 28 July, 2015
Customize dashboard styling and behavior
Apps and add-ons: an introduction

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters