Validate and package
In Validate & Package:
- Validate your add-on for best practices and Splunk App Certification, and test your data inputs, field extractions, and CIM mappings. The Splunk Add-on Builder shows you any errors or warnings, along with recommendations about how to address them.
- Download your add-on package as an SPL file. The SPL format is identical to the tar archive format, but uses the .spl extension rather than .tar.gz.
You can also validate and package apps and add-ons that were not created using the Add-on Builder.
About Splunk App Certification
Splunk App Certification is a process that analyzes your add-on and certifies that it meets certain criteria and verifies that your add-on conforms to best practices. For details, see About app certification on the Splunk Developer Portal.
The Splunk Add-on Builder can validate your add-on to determine whether it is ready to be submitted to Splunk App Certification. When you select APP Pre-certification from the types of validation to perform, the Add-on Builder logs into the App Certification server using your Splunk.com credentials, runs the app pre-certification validation, then displays a "ready" or "not ready" message.
Before you run validation, be sure to provide your Splunk.com credentials:
- From the Splunk Web home page or from the Apps menu, click Splunk Add-on Builder.
- On the Splunk Add-on Builder home page, click Configuration at the top left of the page.
- On the Configuration page, enter your Splunk.com username and password.
- If you use a proxy server, select Enable proxy and fill out the proxy settings.
- To verify your login credentials and proxy settings, click Test.
- Click Save.
Validate the add-on
You can select from the following types of validation to perform on your add-on:
- Best Practices
- CIM Mapping
- Field Extraction
- APP Pre-certification
To validate your add-on:
- On your add-on homepage, click Validate & Package on the Add-on Builder navigation bar.
- Click Validate to run the validation and and display the results.
Overall Health Report | This report displays a health validation score based on the errors, warnings, and failed rules. If you are validating for app pre-certification, this section also lets you know whether your app is ready to be submitted to Splunk App Certification.
This health score is valid in a local environment. The score could be different for the same add-on if the add-on were validated in other environments or at different times due to differences in global knowledge management and differences in indexed data. Use the health score as a subjective indicator about the overall quality of your add-on. |
Error | The total number of errors that were found. |
Warning | The total number of warnings that were found. |
Pass | The number of rules that your add-on passed. |
Validation result distribution | A chart displaying the breakdown of the validation results. |
Validation Rule Details | A list of all the validation rules, with details about the validation category, a description of the rule, and a suggested solution to fix the problem for rules that your add-on did not pass.
Sometimes the suggested remedy is to directly edit a configuration file (.conf). The configuration files for your app are located in $SPLUNK_HOME/etc/apps/TA_your_addon_name, and you can edit them in a text editor. After you save changes to the file, refresh Splunk Web by going to |
For more information about the best practices for add-ons, see:
- About Splunk add-ons in the Splunk Add-ons manual.
- Add-on Best Practice Check Tool
Troubleshoot validation for app pre-certification
If the validation process hangs during app pre-certification, the App Certification server might not be responding.
To troubleshoot the source of the problem, run the following search command:
index=_internal source=*validation.log
Then, if you see results such as the entry below, the problem is with the App Certification server:
2016-09-13 12:48:45,761 DEBUG pid=43871 tid=Thread-1 file=app_cert.py:run:43 | Waiting for App cert finished. Sleep 10 seconds.
Click Stop at any time during the validation process if you think the process is not responding.
You can also switch to other tasks in Add-on Builder while validation is running. The validation process will continue to run in the background until the process has completed or you restart Splunk Enterprise.
Download the add-on package
Creating the installation package for an add-on includes packaging the props, transforms, tags, event types, lookups, modular inputs, setup screens, modular alerts, and prebuilt panels into a single new app and exporting it to a downloadable file.
- Note splunkd must have OS-level access to all files that you manually copy to your add-on directory. splunkd permission is defined by the user running Splunk Enterprise. Insufficient access permission is indicated by a grayed-out Download Package button.
To download your add-on package file:
- On your add-on homepage, click Validate & Package on the Add-on Builder navigation bar.
- Click Download Package to download the installation package for the add-on as an SPL file.
Create alert actions | Advanced |
This documentation applies to the following versions of Splunk® Add-on Builder: 2.0.0
Feedback submitted, thanks!