Customizing Your Splunk Login Screen

If you’re starting to get the hang of administering your shiny Splunk environment and servers, there may come a time when you would like to add some extra information to your login screen or start to give it a more company focused look.

The login screen is an easy place to start when it comes to customizing Splunk. By now you may have noticed that simple changes to text files will go a long way in adding extra functionality or making change to your environment.

In the following post we will make changes to our login screen to have it look and feel a little different to what we are currently use to and allow our own personal brand to shine through.

Where Do We Control Our Login Screen

On your system, all customization to the login screen will be handled in the search head that your users are logging into. A small configuration file named web.conf is located in the $SPLUNK_HOME/etc/system/local/ directory.

$SPLUNK_HOME refers to the home directory of your Splunk server. This will usually be /opt/splunk, but may be configured differently for your environment.

Message Your Users

One of the first things we can do with out login screen is provide a message to our users. This could be in the form of a nice greeting, providing maintenance and upgrade information, or even letting the user know that the server they are accessing is a development or production environment.

If we don’t have one already, we can set up a web.conf file in our $SPLUNK_HOME/etc/system/local/ directory. The config file would have the [settings] tag at the top of the file and our message would simply follow the login_content value. The code would look like this:

[settings]
login_content = <h1>This is a dev server, it’s frequently restarted due to testing purposes</h1>

Notice how we have also included <h1> html tags, in this case to make sure our users see that they are accessing a development server.

Adding A Background Image

The image that Splunk have provided for us when we login is nice, but you may need to adjust this for your specific work environment as users may want to be presented with something specific to their workplace. Although this change can be made via the administration settings in the web interface, we can also perform this change via the web.conf file.

We first need to add our new image into the following directory of our server $SPLUNK_HOME/etc/apps/search/appserver/static/logincustombg/. We then reference this in the web.conf file under the settings tag once again. We would reference with the following entries:

loginBackgroundImageOption = custom
loginCustomBackgroundImage=search:logincustombg/bgimage.jpeg

Simple. We have just told our server that we have a custom background image and where we can find it.

Adding a Logo

Custom logos are similar and just as easy. The only difference is that we need to create a directory to place the logo file in. You would place it in a similar location as you did the background image, for example: $SPLUNK_HOME/etc/apps/search/appserver/static/logo/. All we need to do is then reference this location from our web.conf file as we did with our background:

loginCustomLogo = search:logo/logoimage.png

In summary, the image at the top of the screen, has the following entries web.conf file:

[settings]
login_content = <h1>This is a dev server, it’s frequently restarted due to testing purposes</h1>
loginBackgroundImageOption = custom
loginCustomBackgroundImage=search:logincustombg/bgimage.jpegloginCustomLogo = search:logo/logoimage.png

As you can see it’s easy to get started to configure the look and feel of your Splunk environment, so get to it and try it yourself.

Found this post useful? Kindly tap the ❤ button below! :)

About The Author

Vince has worked with Splunk for over 5 years, developing apps and reporting applications around Splunk, and now works hard to advocate its success. He has worked as a system engineer in big data companies and development departments, where he has regularly supported, built, and developed with Splunk. He has now published his first book via Packt Publishing — Learning Splunk Web Framework.

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Vince Sesto

Vince Sesto

Vincent Sesto is a DevOps Engineer, Endurance Athlete, Coach and Author. One of his passion’s in life is endurance sports as both an athlete, coach and author.