Splunk® Add-on Builder

Splunk Add-on Builder User Guide

Download manual as PDF

Download topic as PDF

Configure data collection using your Python code

In Configure Data Collection, configure the data inputs and setup page for your add-on. This page displays a list of data inputs that you have configured for your add-on. Data inputs determine how you will get data into your add-on:

AOB2.2 chooseinputmethod.jpg

Once you have configured data inputs for your add-on, you can manage them from the Configure Data Collection page in Add-on Builder. Data inputs you configure for your add-on also appear on the Inputs page of the add-on.

  • Data inputs must be enabled so that Splunk Enterprise can start indexing the data from them. You'll need indexed data if you want to perform field extractions and CIM mapping. Data inputs you configure are enabled by default.


Users of your add-on should create data inputs from your configuration within the add-on. Do not direct users to use the Settings > Data inputs page in Splunk Enterprise. When users open your add-on, the Inputs page provides the option to create a new input.

Add a data input by writing your own code

Use this option to implement your own data collection mechanism using Python code.

  1. On your add-on homepage, click the Configure Data Collection icon.
  2. On the Configure Data Collection page, click Add Data.
    The Create Data Input wizard starts.
  3. On the Choose Input Method page, select Modular input using your own Python code.
  4. On the Data Input Properties tab:
    • Enter a name for the source type to create for this data input.
    • Enter an input display name, internal name, and description.
    • Specify a collection interval indicating how often to retrieve data using this input, in seconds.
      If this is a single-instance input, do not set a collection interval.
  5. Click the Data Input Parameters tab to define any parameters that are required for users to configure your data input. At least one parameter is required.
    For each parameter, drag a field from the Component Library to the center panel, then specify its properties in the Property Editor.
  6. Optionally, click the Add-on Setup Parameters tab to define any parameters that are required for users to configure your add-on.
    • Select predefined options to prompt for account, proxy, or logging settings.
    • Add custom inputs by dragging fields from the Component Library to the center panel panel. Select an input to specify its properties in the Property Editor.
    • For more about setup pages, see Create a setup page.

  7. Click Next.
  8. On the Data Input Definition tab in the Code Editor panel, edit the Python code to create your modular input.
    • Add code under the validate_input function to provide validation logic.
    • Add code under the collect_events function to add data collection logic.
    • Add code under the send_http_request function to set SSL certification validation.
    • Use the Python helper functions, which are dynamically generated as commented code, as a guide to working with the input parameters you defined in the previous step.
      The autogenerated code contains a working example that generates a random number.
    • Under Data input parameters, enter sample values for testing the data input.
    AddonBuilder2 EditCode.png
  9. If you created a setup page, click the Add-on Setup Parameters tab to enter sample values for setup parameters for testing purposes.
  10. Click the Data Input Definition tab, then click Test to run your code and test the data input configuration.
    The Output section indicates whether your code succeeded (sample data is displayed) or failed (the error message is displayed).
  11. Click Save to save the data input, then click Finish.


The Add-on Builder displays a summary of the new data input, along with suggested next steps.

Add authentication to a data input

When you need to use authentication for a REST input, add a Global Setup input field to your data input parameters form:

AOB2.2 inputparameters2.jpg

The Global account settings option is automatically selected on your setup page.

To access a username and password in your code, use the following format:

import json
global_account = helper.get_arg('global_account')
username = global_account['username']
password= global_account['password']


When users first open your add-on, they set up their accounts on the add-on's Configuration page:

AddonBuilder2.1 SetupAccount.png

Then, users configure new inputs on the add-on's Inputs page, which displays the data input parameters you configured:

AddonBuilder2.1 SetupDataInput.png

Pass values from data input parameters

Add-on Builder generates the Python helper functions for you to access the values from data input parameters as follows, where "server" is the global parameter name, and "local" is the modular input parameter name:

server = helper.get_global_setting("server")

local = helper.get_param("local")

For more, see Python helper functions.

Single-instance and multi-instance modes

Multi-instance mode runs one instance of a data input per input stanza, resulting in multiple instances (one for each input stanza). This default behavior is useful in multi-thread environments or in situations that require different security contexts or access to different databases.

In a single-thread environment you might want to run an input in single-instance mode. For example, in a WMI environment you would run a single instance of an input to re-use connections.

Multi-instance mode is enabled by default. To enable single-instance mode, do not set a collection interval for the data input, and then uncomment the following lines in the Python code for the data input:

def use_single_instance_mode():
    return True

Learn more

For more information, see the following Splunk Enterprise documentation:

PREVIOUS
Configure data collection using a shell command
  NEXT
Create a setup page

This documentation applies to the following versions of Splunk® Add-on Builder: 2.2.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters