Build an app
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Build an app
You have a lot of different options when building your app. First and foremost, decide on your app's scope and use case. To get you started, here's a high level view of how to build an app for Splunk. There's also an example walk through at the bottom of this page that diagrams building an app for a specific use-case.
Getting started
You can jump right into app building with app builder, but you may also want to carefully plan out and build your app. If so, here are a few things you might want to have set up before you get started.
- A text editor
- You can build apps entirely within Splunk Web, but if you want to do custom XML, CSS or HTML you may want to use a text editor. We recommend Komodo Edit -- it's free, cross-platform and supports text highlighting for a variety of standard formats.
- Useful, relevant data
- Index some data you'll want to showcase in your app.
- You'll build knowledge around this data and present this knowledge through your app's UI.
- Splunk knowledge objects
- Pretty much every app has at least one saved search or report. You'll want to add these as part of your app creation process.
- Web development tools
- These browser dependent tools help you troubleshoot your JavaScript, CSS and HTML.
- If you're doing any advanced customization, we strongly suggest you install and use one of these tools.
- If you're using Firefox, you'll want to check out Firebug.
- IE8 has a built-in console in the Tools menu, under Developer Tools.
- Safari 4 also has a built-in console. First you have to enable the develop menu for the menu bar under Preferences > Advanced Tab. Check Show Developer Menu in menu bar. Then select Develop > Show web inspector.
App building overview
From a high level, app building follows these steps.
1. Create your app workspace:
- Use app builder to create your app workspace.
- Read more about app builder here.
2. Add data and knowledge to your app:
- Add custom configurations to index and process your data.
- Add knowledge to customize how you present your data.
- Read more about how to configure data and objects for your app here.
3. Present data to your app users:
- Add views and dashboards that showcase the data you're indexing.
- Read more about how to customize your app's UI here.
4. Let users set up your app:
- Expose custom configurations to users.
- Learn more about how to configure your app's setup screen here.
5. Users add knowledge to apps:
- Set permissions to allow your app users to add knowledge objects to your app.
- Read more about permissions here.
- The User and Knowledge manager manuals contain more information about adding and configuring knowledge objects.
Example restrict user access
This example walks you through creating an app for a specific use case. You may have some Splunk users in your organization who you want to limit to specific views, searches or data. For example, say you only want your users to be able to search a specific host, and you only want them to see the search view. Here's a general overview of how to do that, with links to relevant documentation.
1. Create a new app for your views.
- Use app builder to create an app.
- More about how to use app builder.
2. Create a role for the users you want to access your app.
- For example, if you're building an app for your web developer team, create a role called "Web_Developer" and add all your users into this role.
- Read more about how to create roles
3. Add views to your app.
- Copy over the views you want in your app, delete the views you don't want.
- More about building views.
4. Set permissions on all your apps and views.
- In Splunk Manager, there's a permissions link next to the lists of all apps and objects.
- Learn more about how object permissions work.
5. Set your new app as a default for your users.
- This means your users will see your app when they log into Splunk.
- Learn more about how to set a default app.
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.