Develop for Splunk
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Develop for Splunk
Once you've gotten Splunk up and running, you've added knowledge and configured your deployment, there's more you can do to make Splunk fit your environment. Splunk offers a rich development platform, with options for customizing the user interface (Splunk Web), hooking into APIs, serving up custom Web content, and tying into third party applications.
Splunk for Developers contains conceptual information, tutorials, and how-tos to help you get started extending the app framework and developing your own apps.
Splunk as a platform
Splunk is a multitiered piece of software that offers you a schemaless backend to store your data, a modular Web-based user interface frontend and a Web server (Cherrypy) in between. Anything you build for Splunk can leverage one or more of these pieces. For example, you can customize the Web UI by adding your own CSS and HTML. Or maybe you want to hook into Splunk from a third party application? You can bypass the UI entirely and access Splunk's datastore via the REST API. It all depends on what you're trying to build and the other applications in your environment.
What is a Splunk developer?
A Splunk developer is anyone who wants to customize Splunk. You don't have to know any programming languages to customize or extend Splunk, although it helps to have a familiarity with Web concepts like HTML, CSS, REST and XML.
This manual is for anyone who wants to make a change to Splunk Web, build a dashboard, a form search or an app, or extend Splunk via the REST API. Developing for Splunk is easy. You don't need to be a developer to build a Splunk app. It helps to be familiar with Splunk's configuration components, but you can pick up this knowledge throughout this manual. The app framework is straightforward enough that you should be able to quickly configure your Splunk installation to suit your use case.
How to develop for Splunk
It's up to you how far you want to take your Splunk install. If you're comfortable with Splunk's object model and configuration files, you may want to build a Splunk app to meet your users. If you're more interested in using Splunk for a datastore and you'd like to display information from Splunk in a separate application, use the REST API to access data, or IFrame in a custom view you've built in Splunk. Or just start off by building your own UI within Splunk -- maybe build a custom dashboard or form search.
This documentation applies to the following versions of Splunk: 4.3 View the Article History for its revisions.