Step 3: Add configurations
Configurations specify behavior for your app. For example, what kind of data do you want to input into your app? What kind of access controls do you want to set up for your app? Configurations include any Splunk config files that structure how your app interacts with the Splunk server. To set up how your app looks (that is, specify app knowledge), proceed to Step 4: add objects.
This section is an overview of the major configuration options available. You can find additional information on configurations in the Splunk Admin Manual and Splunk Getting Data In Manual. Once you've set up custom configurations, you may want to configure an app setup screen to expose relevant app configurations to users setting up your app.
Configurations set up the data layer of your app. The data layer includes data inputs and other configurations that specify how Splunk should treat your data. This way, you can customize what data is available to your app, how it gets into your Splunk instance, and how Splunk stores it.
Many, but not all, apps for Splunk contain back-end configurations. You can use any configuration from the set of configuration files, described in About configuration files in the Admin manual. Put the configuration files in your app's directory to package them with your app.
Note that all configurations are global, meaning they are by default available to all apps. You may segregate configurations by placing them in your app's directory. However, any data inputs indexed into Splunk are always available to other apps.
The most important configuration file for app developers is
app.conf. This file is created by app builder, but you may need to edit it to customize your app.
To enable your app and make it in Splunk Web add the following stanza to the
app.conf file here:
[ui] is_visible = true label = <name>
- The stanza must have the
is_visibleto true if you want your app to appear in the drop-down menu in Splunk Web.
labelto the name of your app.
Add your app to the app launcher
Add the following stanza to
app.conf to add your app into the app launcher. Fill out each attribute as described.
[launcher] author=<author of app> description=<textual description of app> version=<version of app>
Make sure you add the following images to your app's
appIcon.png: This icon appears in the launcher to the left of the app name. App icons must be 36x36 pixels, in PNG format.
screenshot.png: This screenshot appears in launcher above your app description. Screenshots should be a minimum of 623 x 350 pixels in PNG format. If they are larger, they are automatically cropped.
Update content for a new version
app.conf to make your updated assets available to users. Add the
install stanza attribute to your
app.conf file, and specify a build number. For example:
[install] build = 2
- The stanza must have the
- Set the build number to a unique ID. This way, when someones installs a new version of the app, they get the new assets you package with your app.
Configure inputs for your app. Do you want to index a specific type of data just for your app? For example, you may just want to index your Web logs so your Web developers can look at them in one place -- your Web app. Read more about getting data into Splunk in the Getting Data In manual.
Configure custom indexes to store the data for your app. This is the best way to make sure your app users can only search through specific data. Learn more about how to set up multiple indexes in the Admin manual.
Props and transforms
Splunk has rules for processing most data types. But if you have a custom data type you can set segmentation, character set or other custom data processing rules. Create rules for data processing in props.conf and link it to your data via transforms.conf. You can package these configurations with your app, but they will be applied on a source, sourcetype or host basis. Learn more about how Splunk's data processing rules work in the Getting Data In manual.
Users and roles
You can create a custom user or role to access your app and the content within your app. This is a good way to restrict different teams to different content. Learn more About users and roles in the Admin Manual.
Step 2: Create your app
Step 4: Add objects
This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7