Extending Splunk - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 403

head = ''
row = ''
for f in _fields:
head += "<th>" + f + "</th>"
row += "<td>" + str(event.fields.get(f, '-')) + "</td>"
%>
<table class="tabular_eventtype">
<tr>
${head}
</tr>
<tr>
${row}
</tr>
</table>
</%def>
Notice that we have extended the default event type renderer template, which means
we will only change the rendering of the field _raw .
The entry in event_renderers.conf is as follows:
[tabular]
eventtype = tabular
template = tabular.html
Finally, our entries in application.css are as follows:
th.tabular_eventtype {
background-color: #dddddd;
border: 1px solid white;
padding: 4px;
}
td.tabular_eventtype {
background-color: #eeeeee;
border: 1px solid white;
padding: 4px;
}
We are not going to bother giving this event type a definition, but we can use
it by setting the value of eventtype in the query. Let's try it out by running the
following query:
index="implsplunk" | eval eventtype="tabular"