Technical add-on to provide custom Logos and Favicons for the Search Heads Frontend pages and Logo for Reports. This technical addon can then be installed to all your Splunk Servers to have a standartisized setup.
-
Download the TA from splunkbase.com or Github.
-
Install the TA TA_Custom-Logo-and-Favicon to
/opt/splunk/etc/apps/on one of your Search Heads. After the installation you need to adapt some settings before restart Splunk. -
Upload your dedicated favicon.ico in to
appserver/static/customfavicon. There are a lot of online possibilities to create your own favicon. For example: https://www.favicongenerator.com/. -
Edit the custom background image background-splunk-generic-company-logo_1920x1200.png stored in
appserver\static\logincustombgand change it according to your Company logo, etc...- Upload the new background image file back to the
appserver\static\logincustombgfolder. - Depending on your standard screen resolution you may need to change the image size (eg. 1920x1200 or 1024x640, etc ...)
- The fastest way to edit the graphics it is by using paint.net. Download it under https://www.getpaint.net/download.html
- Upload the new background image file back to the
-
Edit the custom background image splunk-company-logo-red.png stored in
appserver\static\logincustomlogoand change it according to your Company logo, etc...- Upload the new Loginpage Logo file back to the
appserver\static\logincustomlogofolder. - The fastest way to edit the graphics it is by using paint.net. Download it under https://www.getpaint.net/download.html
- Upload the new Loginpage Logo file back to the
-
Edit the custom background image logo-standard.png stored in
appserver\static\logincustompdfand change it according to your Company logo, etc...- Upload the new PDF Logo image file back to the
appserver\static\logincustompdffolder. - The fastest way to edit the graphics it is by using paint.net. Download it under https://www.getpaint.net/download.html
- Upload the new PDF Logo image file back to the
-
Restart your Splunk Server:
/opt/splunk/bin/splunk restart
The TA should be configured with the following configuration files:
alert_actions.confweb.conf
Logos and Graphics stored in appserver/static folder
- Dedicated Favicon
- Login page Background image
- Login page company Logo
- PDF Company logo
Note: The app in this repo comes pre-configured with files in
local/. The version on SplunkBase is not preconfigured, and requires the following manual steps.
You can use local/*.conf files in this repo as templates to cofngiure the app in your environment.
Customizes the login page background image. A landscape image is recommended, with a minimum resolution of 1024x640.
Supported image files include .jpg, .jpeg or .png with a maximum file size of 20MB.
Change only the file background-splunk-generic-company-logo_1920x1200.png if you want to have another background image in your login page.
[settings]
### Customization Frontend Graphs
loginBackgroundImageOption = custom
loginCustomBackgroundImage = TA_Custom-Logo-and-Favicon:logincustombg/background-splunk-generic-company-logo_1920x1200.png
Customizes the logo image on the login page. Image file, such as .jpg or .png. All image formats are supported. The maximum image size is 485px wide and 100px high. Will be automatically resized if exceeds these limits.
Change only the file splunk-company-powered-logo-red.png if you want to have another logo in your login page.
### Customization Frontend Logo
loginCustomLogo = TA_Custom-Logo-and-Favicon:logincustomlogo/splunk-company-powered-logo-red.png
Customizes the favicon image across the entire application. Supported favicon image files are .ico files, and should be square images.
Change only the file favicon.ico if you want to have another favicon in your login page. The favicon remains after a login into Splunk.
### Customization Frontend Favicons
customFavicon = TA_Custom-Logo-and-Favicon:customfavicon/favicon.ico
Lets you add custom content to the login page. Supports any text including HTML.
## Dedicated Login Content
login_content = <br><font color=white size=3 face=arial><b><YOUR COMPANY> Splunk Search Enterprise</b></font><br><font size=2>Put here some slogans or important informations.</a></font><br><br><font color=red size=2 face=arial><b>Authorized Access Only!</b></font>
A block of HTML code that defines the footer for an embedded report. Any valid HTML code is acceptable.
### Custom Footer for Embeded PDF
embed_footer = <div class="footer"; align="center">Copyright <b>©</b> 2017-2021 by YOUR COMPANY - all rights reserved.<br>Find us under <a href="https://WWW-YOUR-COMPANY.COM"><img src="/static/app/TA-SRG_Custom-Logo-and-Favicon/company-logo/company-logo.png" title="https://WWW-YOUR-COMPANY.COM" width="49" height="17"/></a></div>
The text to display in the footer of the login page. Supports any text, including HTML.
### Custom Login Page Footer
loginFooterOption = custom
loginFooterText = <div class="footer"; align="center">Copyright <b>©</b> 2017-2021 by YOUR COMPANY - all rights reserved.<br>Find us under <a href="https://WWW-YOUR-COMPANY.COM"><img src="/static/app/TA-SRG_Custom-Logo-and-Favicon/company-logo/company-logo.png" title="https://WWW-YOUR-COMPANY.COM" width="49" height="17"/></a></div>
The text to display in the document title of the login page. Use Text only.
## Page Title Option
loginDocumentTitleOption = custom
loginDocumentTitleText = <YOUR-COMPANY> Security Splunk
Note: The app in this repo comes pre-configured with files in
local/. The version on SplunkBase is not preconfigured, and requires the following manual steps.
You can use local/*.conf files in this repo as templates to cofngiure the app in your environment.
### PDF Logo Settings
pdf.logo_path = TA_Custom-Logo-and-Favicon:logincustompdf/logo-standard.png
You must have a Simple Mail Transfer Protocol (SMTP) server available to send email. This is not included with the Splunk instance.
Specify both and (eg. mailserver = <host>[:<port>]).
### PDF Mailsender Settings
from = <your-team-email-address>
mailserver = <your-smtprelay-server>
auth_username = <your-snmtp-user-name>
mailserver = <your-smtp-user-password>
use_tls = 1
### PDF Disclamer Settings
footer.text = -<< <your-company-name> Enterprise Security SIEM Disclamer >>-\
\
Please, DO NOT REPLY !\
\
As SIEM operators, we take the protection of personal information seriously.\
We treat personal information as confidential and will handle it in accordance with data protection legislation as well as with the terms of this statement.\
\
Any files/attachments transmitted with this eMail are strictly confidential and are intended solely for the use of the individual or entity to whom they are addressed.\
\
If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains.\
Please notify the <your-company-team-name> Team immediately and delete the message from your system.\
\
Thank you for your understanding.\
For any questions, please contact us at <your-team-email-address>\
\
Kind Regards \
<your-company-team-name> Team\
\
+-+-+-+-+-+-+-+-+-+-+-+-+\
<your-company-name>\
<your-company-address>\
<your-company-po-box> <your-company-city>\
Phone <your-company-phone>\
<your-team-email-address>\
<your-company-web-url>\
+-+-+-+-+-+-+-+-+-+-+-+-+
- Login Page Title
- Login Page Logo
- Login Page Content
- Login Page Footer
- PDF Page logo
By default, Splunk logs changes in the $SPLUNK_HOME/etc/ directory every 10 minutes.
In some cases, it may be desirable to do this more frequently, to ensure that no filechanges are missed. If this is desired, add the following to local/inputs.conf:
Once you defined a standard for your Frontend page and PDF printout, you can save the TA locally to your client and install it on all your other servers. If you manage your servers via a deployment server, then deploy the TA via it.
This TA is used to provide a standartisised Login page as well as standartisised PDF template and Mail footer.
This ta provides configuration standards and graphics for the Login page, PDF template and Mail template.
- Added generic graphics for the initial installation
- Updated Manuals to explain how to adapt the graphics and configuration files
-Initial Versionsion
Support is not guaranteed and will be provided on a best effort basis. Please use Github to open issues or feature requests:
| Supported Splunk Versions | Unsupported or Deprecated |
|---|---|
| 8.2.x, 8.1.x, 8.0.x, 7.3.9, 7.3.6 | 7.3.5 and lower, 6.6.x, 6.5.x, 6.4, 6.3, 6.2, older |
This app is supported by Patrick Vanreck (SwissTXT). Contact us under: yoyonet-info@gmx.net.
- Find us under SECLAB Splunk App & TA Development
- Send questions to yoyonet-info@gmx.net
- Developped by Patrick Vanreck
Please find the license for this software here: https://github.com/Splunk-App-and-TA-development/TA_Custom-Logo-and-Favicon/master/LICENSE
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"),
to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.