|Important notice: As part of Advanced XML deprecation, the Module System is officially deprecated beginning with Splunk Enterprise 6.3. For more information, see Advanced XML Deprecation.|
About the Splunk installation
To develop, test and run custom applications, you need to install Splunk. There are no special installation requirements for app development so, if this is your first exposure to Splunk, refer to the Installation Manual for installing and running Splunk.
You'll find the following Installation Manual sections helpful:
- List of supported hardware, operating systems, file systems, and browsers.
- High-level description of the Splunk architecture and installed components.
- Licensing information.
- Installation procedures.
- Starting Splunk.
Developing custom applications that use the Module System requires little more than installing Splunk and using your favorite Web development tools to create and debug your application.
The Module System layer API provides the abstractions needed to extend core Splunk functionality, and customize that functionality for your application domain. The framework API provides access to the same libraries that power Splunk Web, including CherryPy application server access and Mako templating facilities. The API also abstracts the REST interface.
Applications built on the Module System typically use the Splunk module pattern and the familiar MVC pattern. These are described in more detail in the Cookbook. For now, you'll learn the parts of an app by walking though a real-world example.
Where to find the code
After installing Splunk, you'll have access to the Module System API source code. This will be useful for debugging and to review for an even better understanding of how the Module System works. The source files of interest are located in the following directories, where Python2.x is the Splunk Python distribution version:
Note: The pathnames are shown for Linux and differ slightly for Windows.
Your custom app is located in the $SPLUNK_HOME/etc/apps/<yourAppName> directory.
Review the Examples code for the examples used in this document that demonstrate basic app components.
You can also download and install the full set of examples as an app to run the examples from the UI and browse the actual implementation.
- Download Dev_tutorial.zip.
- Extract the file to your
- Restart Splunk.
- Run the Dev_tutorial app.
Your programming environment
Creating source files
Use your favorite text editor or IDE for app development.
Debugging your application
Server-side debugging typically involves logging debug messages to the web_services.log file.
Splunk knowledge prerequisites
To successfully develop custom applications, it is helpful to have an understanding of the following topics:
- and eventually, Mako templates
- Understand Advanced XML, particularly, module hierarchy and how context is passed between modules. Download and run the UI Examples tutorial: Splunk UI examples app for 4.1+)
- Understand application UI behavior as implemented by the ViewController class in view.py:
- Understand structure and behavior of modules that make up a view, as implemented by: module.py:
Anatomy of an app
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.2.0, 7.2.1