What's changed for app developers in 4.2
App ID, version string, and description
An App ID, version string, and a description of an app are required to upload an app or add-on to Splunkbase. Splunk uses the App ID to notify users of updates to an app when the update becomes available on Splunkbase. Splunkbase uses the version string to make sure the latest version is available. The description helps users find apps that fit their needs.
Note: Apps uploaded to Splunkbase prior to September, 2010 did not require an App ID. Splunk recommends that you update these apps with an App ID, version string, and description. For these apps, manually update the app configuration file, and then upload the new version of the app to Splunkbase. The following section, Updating a legacy Splunk application on Splunkbase, describes the procedure.
Updating a legacy Splunk application on Splunkbase
Here are the steps to update an app on Splunkbase to a new version. Splunk recommends you perform this update, even if there are no other changes in the app.
Define an App ID in the package stanza of app.conf
app.confis found at
- The App ID must be unique on Splunkbase.
- The App ID must be the same name as the folder containing the app at:
- App IDs can contain only letters, numbers, and the dot '
.' and underscore '
_' characters. App IDs cannot end with a dot character.
- App IDs cannot be words that indicate a network location, such as CON, PRN, or LPT1.
Define a version string and description in the launcher stanza of app.conf
- Version numbers are a number followed by a sequence of numbers or dots.
- Pre-release versions can append a space and a single-word suffix like "beta2."
- Descriptions are limited to 200 characters of text.
Package and upload the new version of the app to Splunkbase
- See "Uploading a new version of the app to Splunkbase" below for details.
Example app.conf file for UI Examples app
# # Splunk app configuration file # [launcher] version = 1.2 description = This version has been updated to the latest version of Splunk [ui] is_visible = true label = UI Examples [package] id = ui_examples
app.conf spec file
version = <version string> * Version numbers are a number followed by a sequence of numbers or dots. * Pre-release versions can append a space and a single-word suffix like "beta2". Examples: * 1.2 * 11.0.34 * 2.0 beta * 1.3 beta2 * 1.0 b2 * 12.4 alpha * 220.127.116.11.254 description = <string> * Short explanatory string displayed underneath the app's title in Launcher. * Descriptions should be 200 characters or less because most users won't read long descriptions! [package] id = <appid> * id should be omitted for internal-use-only apps which are not intended to be uploaded to Splunkbase * id is required for all new apps uploaded to Splunkbase. Future versions of Splunk will use appid to correlate locally-installed apps and the same app on Splunkbase (e.g. to notify users about app updates) * id must be the same as the folder name in which your app lives in $SPLUNK_HOME/etc/apps * id must adhere to cross-platform folder-name restrictions: - must contain only letters, numbers, "." (dot), and "_" (underscore) characters - must not end with a dot character - must not be any of the following names: CON, PRN, AUX, NUL, COM1, COM2, COM3, COM4, COM5, COM6, COM7, COM8, COM9, LPT1, LPT2, LPT3, LPT4, LPT5, LPT6, LPT7, LPT8, LPT9
Uploading a new version of the app to Splunkbase
Before uploading a new version of an app, make sure you have provided an AppID, version string, and description as described in the previous section.
Prepare your application for upload, as described in Package your app or add-on.
Log in to your example on Splunkbase, click Edit, and follow the instructions on the form to upload your app.
Take advantage of Splunk's reduced restart requirements
Splunk 4.2 has reduced restart requirements when you install or update an application. Now there is a system
app.conf file, located at
$SPLUNK_HOME/etc/system/default/ which lists configuration files that, when delivered by an app update or installation, can be dynamically reloaded (thus avoiding a restart). Configuration changes that are not listed in this file require a restart.
For example, if you install an app that contains a new index, you do not need to restart Splunk to see the new index. The
[triggers] stanza in the system
app.conf file contains the following line, indicating a restart is not necessary:
reload.indexes = access_endpoints /data/indexes
Note: Reduced restart requirements do not apply to changes in the file system change monitor. In
inputs.conf, any updates you make for tracking changes to your file system in an
[fschange] stanza require a restart of Splunk. If you update or add an
[fschange] stanza, then in the
[install] stanza of the app's
app.conf file, make sure you set the following flag:
state_change_requires_restart = true
For more on the file system change monitor, see Monitor changes to your filesystem.
Custom configuration files
- If your app contains custom configuration files, then by default Splunk requires a restart.
- If the custom configuration changes do not require a restart, modify the
[triggers]stanza in your app's app.conf file.
- If your custom configuration requires custom code to reload the configuration state change, specify the endpoint for the custom code in your app's app.conf file.
The app's app.conf file is located at
[triggers] # Do not force a restart of Splunk for state changes of MyApp # Do not run special code to tell MyApp to reload myconffile.conf reload.myconffile = simple # Do not force a restart of Splunk for state changes of MyApp. # Splunk calls the /admin/myendpoint/_reload method in my custom EAI handler. # Use this advanced option only if MyApp requires custom code to reload # the configuration for state change reload.myotherconffile = access_endpoints /admin/myendpoint
State change requires restart flag
[install] stanza of an app's
app.conf file now contains a
state_change_requires_restart flag with a default value of
false. Set this flag to
true only when changes to an app's state always require a restart. Typically, you accept the default value of
false does NOT prevent an app from requiring a restart. Setting this flag to false simply means that Splunk determines whether a restart is required according to the system
app.conf file described above and any settings you may have indicated in the
[triggers] stanza in the app's
System app.conf file
[triggers] reload.alert_actions = simple reload.app = simple reload.commands = simple reload.eventtypes = simple reload.history = simple reload.indexes = access_endpoints /data/indexes reload.lookups = simple reload.macros = simple reload.manager = simple reload.nav = simple reload.outputs = access_endpoints /data/outputs/tcp/server reload.props = simple reload.restmap = rest_endpoints reload.savedsearches = simple reload.searchbnf = simple reload.searchscripts = simple reload.tags = simple reload.times = simple reload.transforms = simple reload.views = simple reload.viewstates = simple reload.workflow_actions = simple reload.inputs = access_endpoints /data/inputs/monitor, /data/inputs/script, /data/inputs/udp, /data/inputs/tcp/raw, /data/inputs/tcp/cooked
How to migrate 3.X apps to 4.1.X
How to restrict your users to one app
This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7