Developing Views and Apps for Splunk Web

Define a custom alert action user interface

Configure the UI for custom actions

When you create custom alert actions, you create an HTML fragment in an HTML file to configure the alert action. The file contains the HTML form portion used for presenting the alert action's input controls. The file does not have a full HTML document.

Place the HTML markup in the following location:

$SPLUNK_HOME/etc/apps/[app name]/default/data/ui/alerts/[HTML file name].html

The Splunk Enterprise UI uses markup consistent with Bootstrap version 2.3.2.

Controls for the form

Use controls within Bootstrap control groups so users can select which actions to enable.

For a control within a control group, match the name attribute for the <input> tag with parameters defined in the savedsearches.conf.spec file. The value that is entered into the text input ends up in savedsearches.conf.

The following example creates a text control that matches the name of a chat room parameter.

.../[app name]/default/data/ui/alerts/[html file name].html

<form class="form-horizontal form-complex">
  <div class="control-group">
      <label class="control-label" for="chat_room">room</label>

      <div class="controls">
        <input type="text" name="action.chat.param.room" id="chat_room" />
        <span class="help-block">chat room to notify</span>
    </div>
  </div>
    . . .
</form>

.../[Add-on]/README/savedsearches.conf.spec

# chat alert settings
action.chat.param.room = <string>
* Name of the room to send the notification to
* (required)
. . .

Security considerations

Only static HTML markup should be used. Do not include scripts or other constructs that could put your system at risk.

Linking to static resources

To include URLS or links to static resources, use the replacement tag {{ SPLUNKWEB_URL_PREFIX }}.