Developing Dashboards, Views, and Apps for Splunk Web

 


Extend Splunk

Extend Splunk

Are you looking to take your Splunk install a little further? Perhaps you'd like to use the Splunk datastore below some custom code you've written. Or you'd like to run searches and get results without using the Splunk UI. Read on for a description of different ways you can extend Splunk via APIs and the CLI.

REST API

If you're looking to extend Splunk to work with your third party app, or you want to run searches or manage Splunk configurations and objects without ever accessing Splunk's UI, you'll want to use Splunk's REST API. Start off by reading Splunk REST API Overview.

The Splunk REST API Reference provides information on all publicly available REST endpoints.

Custom search commands

While Splunk ships with a wide variety of search commands, you may find that you want to add your own. Build your own custom search command to parse and present data in a new way. Note that search commands are not recursive -- they only act on the data they receive back from the search.

Requires a moderate understanding of Python.

CLI

There are quite a few things you can do with Splunk's CLI, like launch searches, retrieve search results, manage configurations and objects. You can also access remote CLIs from another instance, so it is possible to programmatically configure multiple Splunk instances from the CLI. Or just launch several searches and parse the returned results.

This documentation applies to the following versions of Splunk: 4.3 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.