Splunk® Enterprise

Developing Dashboards, Views, and Apps for Splunk Web

Download manual as PDF

Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Step 3: Add configurations

Configurations specify behavior for your app. For example, what kind of data do you want to input into your app? What kind of access controls do you want to set up for your app? Configurations include any Splunk config files that structure how your app interacts with the Splunk server. To set up how your app looks (that is, specify app knowledge), proceed to Step 4: add objects.

This section is an overview of the major configuration options available. You can find additional information on configurations in the Splunk Admin Manual and Splunk Getting Data In Manual. Once you've set up custom configurations, you may want to configure an app setup screen to expose relevant app configurations to users setting up your app.

Configurations set up the data layer of your app. The data layer includes data inputs and other configurations that specify how Splunk should treat your data. This way, you can customize what data is available to your app, how it gets into your Splunk instance, and how Splunk stores it.

Many, but not all, apps for Splunk contain back-end configurations. You can use any configuration from the set of configuration files, described in About configuration files in the Admin manual. Put the configuration files in your app's directory to package them with your app.

Note that all configurations are global, meaning they are by default available to all apps. You may segregate configurations by placing them in your app's directory. However, any data inputs indexed into Splunk are always available to other apps.

App settings

The most important configuration file for app developers is app.conf. This file is created by app builder, but you may need to edit it to customize your app.

Basic configuration

To enable your app and make it in Splunk Web add the following stanza to the app.conf file here:

$SPLUNK_HOME/etc/apps/<app_name>/default/app.conf:
[ui]
is_visible = true
label = <name>
  • The stanza must have the [ui] header.
  • Set is_visible to true if you want your app to appear in the drop-down menu in Splunk Web.
  • Set label to the name of your app.

Add your app to the app launcher

Add the following stanza to app.conf to add your app into the app launcher. Fill out each attribute as described.

[launcher]
author=<author of app>
description=<textual description of app>
version=<version of app> 

Make sure you add the following images to your app's ../appserver/static/ directory:

  • appIcon.png: This icon appears in the launcher to the left of the app name. App icons must be 36x36 pixels, in PNG format.
  • screenshot.png: This screenshot appears in launcher above your app description. Screenshots should be a minimum of 623 x 350 pixels in PNG format. If they are larger, they are automatically cropped.

Update content for a new version

Splunk's appserver caches all static assets in your app (such as images, CSS and Javascript). If you release a new version of your app, you can set app.conf to make your updated assets available to users. Add the install stanza attribute to your app.conf file, and specify a build number. For example:

[install]
build = 2
  • The stanza must have the [install] header.
  • Set the build number to a unique ID. This way, when someones installs a new version of the app, they get the new assets you package with your app.

Inputs

Configure inputs for your app. Do you want to index a specific type of data just for your app? For example, you may just want to index your Web logs so your Web developers can look at them in one place -- your Web app. Read more about getting data into Splunk in the Getting Data In manual.

Indexes

Configure custom indexes to store the data for your app. This is the best way to make sure your app users can only search through specific data. Learn more about how to set up multiple indexes in the Admin manual.

Props and transforms

Splunk has rules for processing most data types. But if you have a custom data type you can set segmentation, character set or other custom data processing rules. Create rules for data processing in props.conf and link it to your data via transforms.conf. You can package these configurations with your app, but they will be applied on a source, sourcetype or host basis. Learn more about how Splunk's data processing rules work in the Getting Data In manual.

Users and roles

You can create a custom user or role to access your app and the content within your app. This is a good way to restrict different teams to different content. Learn more About users and roles in the Admin Manual.

PREVIOUS
Step 2: Create your app
  NEXT
Step 4: Add objects

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters