Set sharing for your modular input script Set the destination index for this source. Splunk does thisĪutomatically, but you can specify what you want if Splunk gets it Other data of the same type when you search. Tell Splunk what kind of data this is so you can group it with Splunk classifies all common data types automatically,īut if you're looking for something specific, you can find more source types If form_data.get('spl-ctrl_sourcetypeSelect')='spl-ctrl_from_list' _('Automatic') if (value=None or value='') else valueįorm_data.get('spl-ctrl_sourcetypeSelect')='sourcetype'Įlse (form_data.get('spl-ctrl_from_list') When this is set to automatic, Splunk classifies andĪssigns the sourcetype automatically, and gives unknown sourcetypes

The widgets available are in the following widgetsdirectory. You can nest widgets inside other widgets. Īn defines a widget to use in a manager page. See the following section, The element tag, for details on child tags to and. The tags has additional child tags that define the widgets and accompanying text in the manager page. Can also take a value beginning with 'spl-ctrl_.' In this case, the element is not bound to a field name, but instead serves a cosmetic purpose. Name: For modular inputs, corresponds to a field name listed in nf. You can nest within an tag.ĭefines the user interface elements for the manager page. Use this tag to specify breadcrumb links to your manager page.įor modular inputs, you typically specify the following: The title Splunk Web displays to access the manager page for your modular input. The endpoint path to modular input endpoints are always in the form listed above for name. is the name of your modular input script.

The name attribute provides the path to the Splunk endpoint for your script. For examples of available tags, see the manager files for the default Search app, as described previously. The following table describes the tags available to create a manager XML file. For individual elements representing widgets, study the modular input examples, and also the data-inputs manager files for the Splunk Search app.For tags, name refers to a field defined for your modular inputs in nf.For the tag, make sure you specify the following:Īlso specify the name of your script for the tag.

In the top-level tag,, make sure name correctly points to the path to the modular input endpoint.When creating a manager XML file, make sure you accurately specify references to your modular inputs and create your widgets correctly. $SPLUNK_HOME/etc/apps/search/default/data/ui/manager/data_inputs_script.xmlĬaution: Be careful not to make any changes to existing manager files. Splunk Enterprise uses manager XML files in the following manager directory to define the contents of pages in Splunk Manager. Modifying existing manager pages or creating new ones affects how users interact with the Splunk server through Splunk Web. You should have familiarity with the Splunk Enterprise framework and be comfortable editing Splunk Enterprise system files. Set sharing for your modular input script so others can access the manager pages.Ĭaution: Creating a custom user interface for modular scripts is an advanced topic.Create a manager.xml file that defines the user interface.Here are the steps for creating a custom Manager page: See Define a scheme for introspection for details on how introspection defines a Manager page. The custom page overrides the Splunk Manager page your modular input script defines during introspection. You can create a custom Manager page for modular inputs that gives you more flexibility in the content displayed.

Splunk inputs.conf xml