Splunk Enterprise 5.0 introduces modular inputs. Modular inputs allow you to extend the Splunk Enterprise framework to define a custom input capability. Your custom input definitions are treated as if they were part of Splunk Enterprise native inputs. From a Splunk Web perspective, your users interactively create and update your custom inputs using Settings, just as they do for Splunk Enterprise native inputs.
To implement Modular Inputs, you specify a custom input stream and configuration specifications. You create a configuration file specification that handles the custom inputs in the Splunk Enterprise framework.Your newly defined inputs are then treated just as if they were a native input stream. You package modular inputs as an app in a Splunk Enterprise deployment or you can distribute them as a Splunk app in Splunk Apps.
Modular inputs provide the following features:
- Splunk Web automatically provides UI access to your custom defined inputs
- You can create, configure, and access the inputs using Splunk Enterprise REST API endpoints.
- You can define runtime behavior for your scripts, such as whether to launch a single instance or multiple instances.
For more information, refer to Modular Inputs topic in this manual.
Custom search commands
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15