Latest version: 3.4.14

Sideview Utils

All of the apps that Sideview makes rely on the modules within Sideview Utils, as do dozens of apps created by partners, customers and by Splunk itself.   Next »
Now that you don't have to fight with 'intentions' anymore, you are free to design the complex form-based interfaces that you've always wanted for your data.   Next »
Using the Sideview modules you will be able to finally link to complex search views and still prepopulate form elements using simple arguments passed in the URL.   Next »
The app itself contains dozens of pages of documentation alongside working examples of the configurations being discussed.   Next »

App Details

Latest version: 3.4.14
Last updated: April 29th, 2021
First released: January 2011
Splunk Cloud compatible: yes
Python3 compatible: yes
CIM compliance: N/A

Give your users more powerful dashboards, and build them in half the time

This app provides key components and tools that make it easier and faster to develop custom Splunk dashboards and views. Chief among these are the Sideview UI modules, which offer improved functionality and easier configurability over Splunk’s legacy Advanced XML modules.

How do I get started?

On the right are links to help you download and install the app.

Once the app is up and running, the app itself is full of walk-through documentation and hundreds of living examples of the configurations being discussed.  There is some additional documentation under the “documentation” link on the right as well – check out the Video section!

Mailing List

If you’re not already on it, get on our mailing list to get notified when there are new releases.  Don’t worry – release updates are the *only* email you will receive from us if you sign up for this mailing list!

Wait I thought the Advanced XML was going away?

You may have heard that Splunk deprecated the Advanced XML a while ago. Sideview Utils, although it has long ago circumvented or replaced most of the advanced XML code, does indeed still live on top of the Advanced XML. What has been happening over the last 2 years is that completely new systems have been written, with the idea being that your Sideview XML views, if authored according to reasonable practices as recommended in Sideview Utils, will live on even after Splunk turns off the “advanced XML”. Essentially this amounts to a new front end for Splunk, and the only integration point this UI has with SplunkWeb is that the HTML is served out of a custom python controller. At the moment this is in the form of an unreleased app called “Canary”. I can’t tell you very much beyond the fact that a) there is a working version, b) It is a great deal faster, and c) most likely we will migrate away from the old XML format into a new format that is much less deeply nested and easier to deal with.

What are the advantages of Sideview Utils / Canary over say SimpleXML and SplunkJS?

The considerable advantage of Sideview Utils is the same as it has always been – that if you read through the docs and examples, that you can dream up and implement very complex dashboards with rich interaction and drilldowns without having to know any programming language at all. You might say that this is the case with the Simple XML, but the problem with the Simple XML is that it long ago stopped being simple. And even with all the complexity that it has, it is still quite limited when you try and implement the idiosyncratic and odd UI needs that your business has given you.

You can read an old but still relevant writeup of this in this question on