Event renderers give you the ability to make a specific template for a specific event type. To read more about creating event types, see Chapter 7, Extending Search.
Event renderers use mako templates (http://www.makotemplates.org/).
An event renderer comprises the following:
- A template stored at $SPLUNK_HOME/etc/apps/[yourapp]/appserver/event_renderers/[template].html
- A configuration entry in event_renderers.conf
- An optional event type definition in eventtypes.conf
- Optional CSS classes in application.css
Let's create a few small examples. All the files referenced are included in $SPLUNK_HOME/etc/apps/ImplementingSplunkExtendingExamples. These examples are not shared outside this app, so, to see them in action, ...