Step 3: Add configurations

Configurations specify behavior for your app. For example, what kind of data do you want to input into your app? What kind of access controls do you want to set up for your app? Configurations include any Splunk Enterprise configuration files that structure how your app interacts with the server splunkd server. To set up how your app looks (that is, specify app knowledge), proceed to Step 4: add objects.

This section is an overview of the major configuration options available. You can find additional information on configurations in the Admin Manual and Getting Data In manual. Once you've set up custom configurations, you may want to configure an app setup screen to expose relevant app configurations to users setting up your app.

Configurations set up the data layer of your app. The data layer includes data inputs and other configurations that specify how to treat your data. This way, you can customize what data is available to your app, how it gets into your Splunk Enterprise instance, and how to store the data.

Many, but not all, apps contain back-end configurations. You can use any configuration from the set of configuration files, described in About configuration files in the Admin Manual. Put the configuration files in your app's directory to package them with your app.

All configurations are global, meaning they are by default available to all apps. You can segregate configurations by placing them in your app's directory. However, any data inputs indexed are always available to other apps.

App settings

The most important configuration file for app developers is app.conf. This file is created by app builder, but you may need to edit it to customize your app.

Basic configuration

To enable your app and make it visible in Splunk Web add the following stanza to the app.conf file here:

$SPLUNK_HOME/etc/apps/<app_name>/default/app.conf:

[ui]
is_visible = true
label = <name>

• The stanza must have the [ui] header.
• Set is_visible to true if you want your app to appear in the drop-down menu in Splunk Web.
• Set label to the name of your app.

Add your app to the app launcher

Add the following stanza to app.conf to add your app into the app launcher. Fill out each attribute as described.

[launcher]
author=<author of app>
description=<textual description of app>
version=<version of app> 

Add app icon images

Place app icon images at the following location:

$SPLUNK_HOME/etc/apps/<app_name>/static/

Icon paths are case sensitive. Example: static/appIcon.png, and not static/AppIcon.png. Refer to the table below for the case configuration of which images for app icons that Splunkbase supports..

Image files must be PNG format. For best results, use 24 bit transparency with your images.

Splunk Enterprise supports the following images for app icons.

Filename	Total Image Size*	Suggested Display Size	Placement**
appIcon_2x.png	72 x 72	36 x 36 or less	App list on Splunk Home Page (High Resolution Displays)
appIcon.png	36 x 36	36 by 36 or less If the box is totally filled, it may feel too big.	App list on Splunk Home Page (Standard resolution displays)
appIconAlt_2x.png	72 x 72	36 x 36 or less	App menus for Splunk Bar and Search Bar (High resolution displays)
appIconAlt.png	36 x 36	36 by 36 or less	App menus for Splunk Bar and Search Bar (Standard resolution displays)
appLogo.png	160 x 40 (Maximum size)	160 x 40 (Maximum size, Leave some vertical margin)	App Bar on standard resolution displays
appLogo_2x.png	320 x 80 (Maximum size)	320 x 80 (Maximum size, Leave some vertical margin)	App Bar on high resolution displays

*Image sizes are in pixels
**High resolution displays include MacBookPro with Retina Display

AppIcon_2x.png AppIcon.png       

Update content for a new version

The Splunk Enterprise appserver caches all static assets in your app, such as images, CSS and Javascript. If you release a new version of your app, you can set app.conf to make your updated assets available to users. Add the install stanza attribute to your app.conf file, and specify a build number. For example:

[install]
build = 2

• The stanza must have the [install] header.
• Set the build number to a unique ID. This way, when someones installs a new version of the app, they get the new assets you package with your app.

Inputs

Configure inputs for your app. Do you want to index a specific type of data just for your app? For example, you may just want to index your Web logs so your Web developers can look at them in one place -- your Web app. Read more about getting data into Splunk Enterprise in the Getting Data In manual.

Indexes

Configure custom indexes to store the data for your app. This is the best way to make sure your app users can only search through specific data. Learn more about how to set up multiple indexes in the Admin manual.

Props and transforms

There are rules for processing most data types. But if you have a custom data type you can set segmentation, character set or other custom data processing rules. Create rules for data processing in props.conf and link it to your data via transforms.conf. You can package these configurations with your app, but they will be applied on a source, sourcetype or host basis. Learn more about how data processing rules work in the Getting Data In manual.

Users and roles

You can create a custom user or role to access your app and the content within your app. This is a good way to restrict different teams to different content. Learn more About users and roles in the Admin Manual.