For customers of existing commercial apps

If you’re a customer of one of our existing commercial apps for Splunk, here’s what you need to know.

In Splunk 8 and higher, you will have to install the Canary app as well as the Sideview Utils app.
Put another way, our existing commercial apps will not run at all on Splunk 8 until the Canary is also installed on the Search Head or SHC.
Canary is essentially a replacement for, and an upgrade over, the old Sideview Utils app. Technically the only reason Sideview Utils needs to remain at all on 8.X is so that some of the automatic redirects from legacy Advanced XML URLs to the equivalent Canary URLs work properly.

You can download and install Canary today
IMPORTANT NOTE: Before doing this you must first update to the latest released version of the other Sideview apps.
It is easy to get Canary installed because it is also on Splunkbase — from Splunk’s in-product Apps browser (go to Apps > Find more apps > search for ‘canary’).

If your Splunk deployment is unable to reach Splunkbase you can also download it as a tar.gz file from Splunkbase or directly from this website.

The functionality of your app will be unchanged, however the look and feel of the UI will be noticeably different.
We’re eager to hear any and all feedback.
We apologize in advance for any defects you encounter and we will try and fix them as quickly as possible.
We hope that the change is positive. For one thing pages in the Canary UI render a great deal faster. Certainly faster than they did before in the old Splunk UI, but also faster than Splunk’s “Simple xml” dashboards. You may even get a little spoiled by this.

You don’t need any new special license.
As a part of your existing license agreement for the commercial app, Sideview is effectively granting you a license to use the Canary app in conjunction with that commercial app.
The app will be fully supported to run in the Canary UI on Splunk 8 and up, and will also remain supported on 7.X in the old Splunk UI.
If (or when) you find defects on either side, please do report them and we’ll be working hard and probably shipping maintenance releases monthly if not weekly so check back often.
NOTE: at the moment if you try to navigate *to* the Canary app itself in Splunk, it will require that you go to our website to generate a trial license for Canary. This will be fixed soon and it will recognize your Cisco CDR license as perfectly good to browse the Canary pages.

Canary runs fine in both Python2 and Python3
Canary’s pieces are already all tested and supported in Python3 so Canary will run just fine on Splunk 8. If you encounter any problems of course let us know.

We are scheduling some webinars where you can hear more and ask questions.
The first will be this Thursday October 17th at 9am Pacific (12pm Eastern time). Email us at or use our contact form on this website to request an invite, or if that time doesn’t work we can try to schedule a quick webex with you.

We (Rich + Nick) will be at the Splunk User Conference!
We won’t have a booth there this year, however we will both be floating around the “Ask The Experts” area and we should be relatively easy to find in the Community areas overall.  For more info (which we’ll try to keep up to date), see this blog post on conf19.

Nick will also be giving two talks. Note that neither of these talks is about Canary or even Sideview, but come anyway because they’re interesting.
1) Master Joining without using join
2) Wayback machine – Driving around in Splunk 1.0, 2.0 and 3.4