https://splunk.github.io/hugo-theme-splunk-workshop/Recent content in Learn by *building*. on Splunk Workshops · DemoHugoenhttps://splunk.github.io/hugo-theme-splunk-workshop/docs/getting-started/00-run-locally/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/getting-started/00-run-locally/Two ways to use the theme: clone this repo to try the demo or contribute, or install it into a brand-new Hugo site you own. This chapter covers the first path. For the second, see Install . Prerequisites # Hugo extended 0.125 or newer. Check with hugo version — the build line must include extended. macOS: brew install hugo Linux: download the _extended_ .deb / .rpm from gohugo.io/installation ↗ (package-manager versions are usually outdated and non-extended) Windows: choco install hugo-extended Git (any recent version).https://splunk.github.io/hugo-theme-splunk-workshop/docs/shortcodes/01-callouts/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/shortcodes/01-callouts/Callouts are the most-used shortcode in any workshop. The theme ships one shortcode — notice — with six built-in styles, each with its own color and icon. It’s a drop-in for hugo-theme-relearn’s notice ↗ , so existing relearn content migrates verbatim. The six styles # Tip A warm, helpful aside. Use for shortcuts, mnemonics, and “you’ll thank me later” details. Note A neutral aside. Useful when you want to set something off without raising an alarm.https://splunk.github.io/hugo-theme-splunk-workshop/docs/customizing/01-colors/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/customizing/01-colors/Every color the theme uses is a CSS custom property fed by a Hugo param. Override any of them in your site’s hugo.toml to rebrand instantly. The signature gradient # The theme’s defining motif is the official Splunk brand gradient — Magenta 50 → Orange 50 with stops at 10% / 90%. It appears on the hero <em>, step circles, the chapter weight number, the progress bar, the pager hover, and a dozen other places.https://splunk.github.io/hugo-theme-splunk-workshop/docs/authoring/archetype-examples/01-default/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/authoring/archetype-examples/01-default/This page was generated from the default archetype. The front matter is the minimum Hugo requires: date, draft, title. Nothing workshop-specific — no time, no difficulty, no tags. Use this archetype when the page isn’t part of a workshop. Examples: an About page, a contact form, a privacy policy, an internal index. Prose, links, and code blocks all work the same as on a workshop page; you just don’t get the workshop-meta row up top because there are no workshop-meta keys in the front matter.https://splunk.github.io/hugo-theme-splunk-workshop/docs/authoring/01-front-matter/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/authoring/01-front-matter/The theme respects all of Hugo’s standard front-matter keys plus a handful of theme-specific ones. Here’s the complete list. Standard Hugo keys # yaml Copy +++ title = "Your First Search" # rendered as the H1 linkTitle = "Your First Search" # used in sidebar and pager (default: title) description = "Ingest sample data..." # rendered under the H1 as the lead paragraph date = "2026-01-15" # publication date weight = 30 # controls order in lists and pager draft = false # exclude from production builds tags = ["spl", "search"] # added to /tags/ taxonomy layout = "chapter" # use a non-default layout +++ weight is the most important — it controls everything about ordering: the sidebar, the pager, card grids, the children listing.https://splunk.github.io/hugo-theme-splunk-workshop/docs/advanced/01-modules/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/advanced/01-modules/Hugo Modules are the modern way to consume themes. They give you version pinning, easy upgrades, and — most powerfully — the ability to override individual files without forking the theme. Pinning a version # bash Copy hugo mod get github.com/splunk/hugo-theme-splunk-workshop@v0.1.0 Hugo writes the resolved version to your go.mod. Future hugo build and hugo server invocations use that exact version. Available tags are on the releases page ↗ . To upgrade everything:https://splunk.github.io/hugo-theme-splunk-workshop/docs/getting-started/01-install/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/getting-started/01-install/Hugo extended 0.125 or newer is required. Check with hugo version — you want a build that says extended. Pick your method # Hugo Module (recommended)Git submoduleDirect download Hugo Modules give you version-pinned installs and one-command upgrades. Requires Go 1.18+ for the one-time init. bash Copy # 1. Init your site as a Hugo Module (one time only) hugo mod init github.com/your-org/your-site # 2. Add the theme as a dependency hugo mod get github.https://splunk.github.io/hugo-theme-splunk-workshop/workshops/getting-started/01-introduction/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/workshops/getting-started/01-introduction/Welcome. Over the next hour, you’ll go from an empty terminal to a working Splunk dashboard with live, queryable data. We’ll move quickly — but every step has an escape hatch if you get stuck. Why this workshop # Splunk is at its best when you see results in minutes, not days. This workshop is intentionally hands-on: you’ll be typing into a real terminal, pressing real keys, and watching real events stream in.https://splunk.github.io/hugo-theme-splunk-workshop/docs/authoring/02-archetypes/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/authoring/02-archetypes/Archetypes are templates that Hugo uses when you run hugo new. The theme ships five: default, chapter, workshop, lesson, and exercise. Pick the one that matches the shape of the page you’re creating. Each archetype is wired up to a live demo page in this site — open Archetype examples to see them rendered side-by-side with their source. The five archetypes # default — generic page # bash Copy hugo new content/about.https://splunk.github.io/hugo-theme-splunk-workshop/workshops/getting-started/02-installation/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/workshops/getting-started/02-installation/Splunk Enterprise runs on every major OS. Pick your platform, run the install command, and you’ll have a server listening on port 8000 within a few minutes. Choose your platform # macOSLinuxDocker The fastest path on macOS is Homebrew. If you don’t have Homebrew yet, install it first ↗ . install.sh Copy brew install --cask splunk-enterprise sudo /Applications/Splunk/bin/splunk start --accept-license When the prompt asks for an admin username and password, choose something memorable — you’ll be using it constantly.https://splunk.github.io/hugo-theme-splunk-workshop/docs/advanced/02-presenter/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/advanced/02-presenter/Workshops are often delivered live. Presenter mode lets you embed timing cues, “kick off the demo container in the background”, and other facilitator notes directly in your markdown — visible only when you toggle them on. How to use it # Wrap presenter-only content in a presenter shortcode: markdown Copy {{< presenter >}} Start the EC2 instance — boot takes ~3 minutes. {{< /presenter >}} {{< presenter title="Timing" >}} Allow 10 minutes for attendees to finish this section.https://splunk.github.io/hugo-theme-splunk-workshop/docs/customizing/02-fonts/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/customizing/02-fonts/The theme defaults to Splunk Data Sans Pro (the official Splunk typeface, also used on help.splunk.com) for display and body, paired with JetBrains Mono for code. Three params change every font on the site; one is loaded from Splunk’s CDN, the other two from Google Fonts. The three font slots # toml Copy [params] # Splunk Data Sans Pro is loaded via @font-face rules emitted by # theme-vars.html (six weights from Splunk's own CDN).https://splunk.github.io/hugo-theme-splunk-workshop/docs/authoring/archetype-examples/02-workshop/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/authoring/archetype-examples/02-workshop/This page was generated from the workshop archetype. The chips at the top — 15 min, Beginner, the two tag badges — come from the front matter below; the icons and styling come from the workshop-meta ↗ partial reading those keys. Workshop is the lean starting point. lesson and exercise (next pages) inherit the same front-matter shape but pre-seed more body structure. Generated by # bash Copy hugo new --kind workshop content/workshops/getting-started/01-intro.https://splunk.github.io/hugo-theme-splunk-workshop/docs/shortcodes/02-structure/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/shortcodes/02-structure/These shortcodes give a workshop its skeleton — the steps the reader follows, the exercises they try, and the milestones that confirm they’re on track. Steps # 1 Auto-numbered with a gradient marker5 min Steps are the backbone of any procedure. Each one auto-increments via Hugo’s Scratch so you don’t have to renumber when you reorder. bash Copy echo "Steps can contain anything — code, callouts, tables, anything." 2 The next one in the sequence2 min A faint connecting line runs between consecutive steps so the eye doesn’t lose place when scrolling fast.https://splunk.github.io/hugo-theme-splunk-workshop/docs/getting-started/02-first-page/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/getting-started/02-first-page/Workshops in this theme are folders. A folder with an _index.md is a chapter; the markdown files inside are its lessons. The pager and sidebar are derived from that structure. Create the chapter # bash Copy hugo new --kind chapter content/workshops/getting-started/_index.md The chapter archetype gives you front matter like: yaml Copy +++ title = "Getting Started" description = "Your first hour with the platform." weight = 1 layout = "chapter" subtitle = "Chapter · Foundation" +++ The layout = "chapter" is what unlocks the gradient-weight hero.https://splunk.github.io/hugo-theme-splunk-workshop/docs/advanced/08-progress-tracking/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/advanced/08-progress-tracking/Every workshop page an attendee dwells on for 2 seconds gets remembered. The theme paints a small pink dot in the sidebar next to every page they’ve already visited, so it’s instantly obvious what’s been covered and what’s still ahead. State lives in the attendee’s browser only — no account, no backend, no telemetry. What an attendee sees # After visiting two lessons in a four-lesson workshop: text Copy splunk> Workshop • Introduction ← visited, pink dot in the gutter • Installation ← visited Your First Search ← current page (bold + accent border) Going Further ← not yet visited The dot intensifies (full opacity, slight scale-up) on the active page so the “you’re here” signal is never lost.https://splunk.github.io/hugo-theme-splunk-workshop/docs/getting-started/03-deploy/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/getting-started/03-deploy/The theme produces a fully static site. Anywhere that serves files works. GitHub Pages (recommended for the demo) # The theme repo ships with a workflow at .github/workflows/pages.yml that builds exampleSite/ and publishes to the gh-pages branch on every push to main. To use it for your own site: 1 Enable Pages1 min In your repo settings, Pages → Source → GitHub Actions. 2 Adapt the workflow2 min Copy .github/workflows/pages.yml from this theme into your own site, and adjust the --source flag if your Hugo project lives at the repo root (drop the --source exampleSite argument).https://splunk.github.io/hugo-theme-splunk-workshop/docs/shortcodes/03-layout/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/shortcodes/03-layout/The visual building blocks for non-prose content — anything you’d want to break into columns, a labeled chip, or a visually distinct block. Tabs # A simple tab block: macOSLinuxWindows bash Copy brew install hugo bash Copy sudo apt install hugo powershell Copy choco install hugo-extended markdown Copy {{< tabs >}} {{< tab "macOS" >}} ... {{< /tab >}} {{< tab "Linux" >}} ... {{< /tab >}} {{< /tabs >}} Tabs with groupid (synced) # When a workshop has many tab blocks for the same axis (OS, language, environment), pass a shared groupid and they’ll stay in sync — picking “Linux” once selects it everywhere.https://splunk.github.io/hugo-theme-splunk-workshop/docs/authoring/archetype-examples/03-lesson/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/authoring/archetype-examples/03-lesson/One-sentence summary of what this lesson covers and why the reader should care. The lead block at the top is what the lesson archetype seeds for you — a clear “here’s what we’re about to do” before the meaty sections begin. This page was generated from the lesson archetype. It’s a step up in opinion from workshop: the body is pre-structured to mirror how strong workshop lessons read end-to-end — what you’ll learn up top, concept in the middle, walkthrough for the hands-on portion, wrap up that pivots forward.https://splunk.github.io/hugo-theme-splunk-workshop/docs/customizing/03-logos/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/customizing/03-logos/The header and footer use a single .brand element that auto-swaps between a light-mode and dark-mode logo. If you don’t supply a logo, a text wordmark renders in its place. Logos # Drop your files into static/images/, then point the params at them: toml Copy [params] logoLight = "images/your-logo-black.svg" # shown in light mode logoDark = "images/your-logo-white.svg" # shown in dark mode (optional) logoHeight = "26" # height in pixels Both logoLight and logoDark are paths relative to static/.https://splunk.github.io/hugo-theme-splunk-workshop/docs/authoring/03-navigation/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/authoring/03-navigation/Five rules cover 100% of the theme’s navigation behavior. Once you know them, you can predict exactly where any page will appear. Rule 1 — Order is by weight, then title # Every list (sidebar, pager, card grid, search index) is sorted ascending by weight. Pages with the same weight are sorted by title next, then by file path. The convention used throughout the theme is weight = 10, 20, 30, … so you can insert pages without renumbering.https://splunk.github.io/hugo-theme-splunk-workshop/docs/advanced/03-search/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/advanced/03-search/The theme ships a fully self-contained client-side search — no Algolia, no external service, no build step. Press / to try it. How it works # When Hugo builds your site, it emits a /index.json file containing every regular page’s title, description, section, URL, tags, and a 600-character summary of the body. The JavaScript modal fetches this file once on first open, scores entries against the user’s query with a small substring + word-prefix matcher, and renders the top 12 results.https://splunk.github.io/hugo-theme-splunk-workshop/workshops/getting-started/03-first-search/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/workshops/getting-started/03-first-search/SPL is the language Splunk speaks. It reads left-to-right like a Unix pipeline, and you’ll be fluent enough to build a dashboard before this page ends. Walkthrough # 1 Ingest the sample data3 min Splunk ships with a tutorial dataset. Upload it from the Add Data screen, or use the CLI: bash Copy splunk add oneshot $SPLUNK_HOME/etc/apps/search/lookups/tutorial.csv \ -sourcetype tutorial \ -index main Once the upload finishes, switch to Search & Reporting and pick Last 24 hours as the time range.https://splunk.github.io/hugo-theme-splunk-workshop/docs/shortcodes/04-code/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/shortcodes/04-code/Code is what makes a workshop a workshop. The theme treats fenced code blocks as a first-class citizen — every block gets a copy button, optional file-name header, optional line highlighting, and theme-aware syntax colors. Standard fenced block # markdown Copy ```js function hello(name) { return `Hello, ${name}!`; } ``` Renders as: js Copy function hello(name) { return `Hello, ${name}!`; } The copy button in the top-right is wired by assets/js/copy-code.https://splunk.github.io/hugo-theme-splunk-workshop/docs/authoring/archetype-examples/04-exercise/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/authoring/archetype-examples/04-exercise/What the reader will build in this exercise. State the end-state clearly so they know when they’re done — “you’ll have a working curl against the API returning 200, and you’ll be able to read the response body” is much more useful than “you’ll learn about HTTP.” This page was generated from the exercise archetype. Notice it has no prev/next pager at the bottom — that’s because the archetype sets nopager = true.https://splunk.github.io/hugo-theme-splunk-workshop/workshops/getting-started/04-going-further/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/workshops/getting-started/04-going-further/You shipped a working Splunk install, ingested data, and turned raw events into a dashboard. The rest is repetition and depth. This page is your wrap-up: a video summary, a cheat sheet to take home, downloadable starter configs, and pointers to the workshops most people tackle next. Presenter Note For instructors: the next 10 minutes are for Q&A and the LinkedIn cert link. Drop the video if you’re short on time — the cheat sheet and follow-on workshops are the high-value takeaways.https://splunk.github.io/hugo-theme-splunk-workshop/docs/advanced/04-i18n/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/advanced/04-i18n/Every UI string in the theme — “Previous”, “Next”, “On this page”, “Search workshops…”, and 40 more — lives in i18n/en.yaml. Translate by adding a sibling file. Adding a translation # Drop a new file at i18n/<lang>.yaml in your site (or in the theme), copying i18n/en.yaml and translating each value: yaml Copy # i18n/de.yaml — German - id: home translation: "Startseite" - id: previous translation: "Zurück" - id: next translation: "Weiter" - id: onThisPage translation: "Auf dieser Seite" - id: searchPlaceholder translation: "Workshops durchsuchen…" # … etc.https://splunk.github.io/hugo-theme-splunk-workshop/docs/customizing/04-toggles/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/customizing/04-toggles/Six boolean params and one width param control the major layout decisions. Flip them in hugo.toml to suppress chrome you don’t need. All toggles # toml Copy [params] defaultMode = "auto" # "light" | "dark" | "auto" showThemeToggle = true # sun/moon button in the header showSidebar = true # left workshop nav on workshop pages showToc = true # right-rail "On this page" showProgress = true # gradient reading-progress bar showLightTrails = true # decorative gradient streaks in hero/footer contentMaxWidth = "720px" # prose column width on workshop pages When to flip each # defaultMode # auto honors prefers-color-scheme on first visit; the user can override via the toggle and their choice persists in localStorage.https://splunk.github.io/hugo-theme-splunk-workshop/docs/shortcodes/05-heavyweights/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/shortcodes/05-heavyweights/Math, diagrams, and video are expensive — KaTeX is ~150KB, Mermaid is ~700KB. The theme lazy-loads each one only when a page actually uses it, via Page.Store flags read in the footer. Math (KaTeX) # $$e^{i\pi} + 1 = 0$$ $$\text{p95} = \inf\{x : F(x) \geq 0.95\}$$ markdown Copy {{< math >}} e^{i\pi} + 1 = 0 {{< /math >}} The shortcode wraps your LaTeX in $$ … $$ (display mode) and flags the page so KaTeX is loaded from CDN in the footer.https://splunk.github.io/hugo-theme-splunk-workshop/docs/advanced/05-from-relearn/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/advanced/05-from-relearn/The theme ships drop-in aliases for the most-used relearn shortcodes, so most workshop content moves over unchanged. This page is the explicit checklist — what’s compatible, what isn’t, and the new affordances you pick up after the swap. Drop-in aliases # These shortcodes exist with relearn-compatible names so your existing markdown keeps working: Relearn shortcode This theme Notes notice notice Identical API: {{< notice tip "Title" >}}. Full param surface — style, title, icon, color, expanded, groupid.https://splunk.github.io/hugo-theme-splunk-workshop/docs/advanced/06-troubleshooting/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/advanced/06-troubleshooting/Symptom → cause → fix, for the issues most likely to show up in the first 24 hours of using the theme. Links 404 on GitHub Pages but work locally # Symptom. http://localhost:1313/docs/foo/ works in hugo server, but the deployed site at https://owner.github.io/repo/docs/foo/ returns 404. Cause. The published site lives under a path prefix (/repo/), but a link in your markdown or a template emits a domain-rooted /docs/foo/ href that the browser resolves to https://owner.https://splunk.github.io/hugo-theme-splunk-workshop/docs/shortcodes/06-utilities/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/shortcodes/06-utilities/Ten smaller shortcodes that don’t fit the other categories — file lists, page-tree helpers, templating utilities, and a couple of Splunk-specific embellishments. File downloads # attachments # Lists every non-content file in a page bundle as a downloadable link. Useful for workshop slide decks, sample data, or starter zips that ship alongside the markdown. markdown Copy {{< attachments >}} Place a page bundle at content/workshops/intro/index.md and drop lab-data.csv, slides.pdf next to it.https://splunk.github.io/hugo-theme-splunk-workshop/docs/advanced/07-multilingual/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/docs/advanced/07-multilingual/The theme ships ready for multilingual content but doesn’t force it. Single-language sites need no setup; once you opt in, the header gains a language switcher and Hugo gates each translation behind its own URL prefix. Decide your strategy # Hugo offers two ways to organise multilingual content: Translation by filename — post.md, post.ja.md side-by-side. Good for ~1:1 translations of small sites. Translation by directory — content/en/, content/ja/, …, each a parallel content tree.https://splunk.github.io/hugo-theme-splunk-workshop/snippets/cheatsheet/Mon, 01 Jan 0001 00:00:00 +0000https://splunk.github.io/hugo-theme-splunk-workshop/snippets/cheatsheet/SPL Cheat Sheet # A short reference of the most-used SPL commands. Embedded into other pages via the include shortcode. Command Purpose Example search Filter events search status=500 stats Aggregate stats count by host eval Compute fields eval is_error = if(status>=500, 1, 0) where Post-filter where count > 10 sort Reorder sort -count head Top N head 20 Combine them with the pipe (|) — left to right, output of one is the input of the next.