
Step 3: Add configurations
Configurations specify behavior for your app. For example, what kind of data do you want to input into your app? What kind of access controls do you want to set up for your app? Configurations include any Splunk Enterprise configuration files that structure how your app interacts with the server splunkd
server. To set up how your app looks (that is, specify app knowledge), proceed to Step 4: add objects.
This section is an overview of the major configuration options available. You can find additional information on configurations in the Admin Manual and Getting Data In manual. Once you've set up custom configurations, you may want to configure an app setup screen to expose relevant app configurations to users setting up your app.
Configurations set up the data layer of your app. The data layer includes data inputs and other configurations that specify how to treat your data. This way, you can customize what data is available to your app, how it gets into your Splunk Enterprise instance, and how to store the data.
Many, but not all, apps contain back-end configurations. You can use any configuration from the set of configuration files, described in About configuration files in the Admin Manual. Put the configuration files in your app's directory to package them with your app.
All configurations are global, meaning they are by default available to all apps. You can segregate configurations by placing them in your app's directory. However, any data inputs indexed are always available to other apps.
App settings
The most important configuration file for app developers is app.conf
. This file is created by app builder, but you may need to edit it to customize your app.
Basic configuration
To enable your app and make it visible in Splunk Web add the following stanza to the app.conf
file here:
$SPLUNK_HOME/etc/apps/<app_name>/default/app.conf:
[ui] is_visible = true label = <name>
- The stanza must have the
[ui]
header. - Set
is_visible
to true if you want your app to appear in the drop-down menu in Splunk Web. - Set
label
to the name of your app.
Add your app to the app launcher
Add the following stanza to app.conf
to add your app into the app launcher. Fill out each attribute as described.
[launcher] author=<author of app> description=<textual description of app> version=<version of app>
Add app icon images
Place app icon images at the following location:
$SPLUNK_HOME/etc/apps/<app_name>/static/
Icon paths are case sensitive. Example: static/appIcon.png, and not static/AppIcon.png. Refer to the table below for the case configuration of which images for app icons that Splunkbase supports..
Image files must be PNG format. For best results, use 24 bit transparency with your images.
Splunk Enterprise supports the following images for app icons.
Filename | Total Image Size* | Suggested Display Size | Placement** |
---|---|---|---|
appIcon_2x.png | 72 x 72 | 36 x 36 or less | App list on Splunk Home Page (High Resolution Displays) |
appIcon.png | 36 x 36 | 36 by 36 or less If the box is totally filled, it may feel too big. |
App list on Splunk Home Page (Standard resolution displays) |
appIconAlt_2x.png | 72 x 72 | 36 x 36 or less | App menus for Splunk Bar and Search Bar (High resolution displays) |
appIconAlt.png | 36 x 36 | 36 by 36 or less | App menus for Splunk Bar and Search Bar (Standard resolution displays) |
appLogo.png | 160 x 40 (Maximum size) |
160 x 40 (Maximum size, Leave some vertical margin) |
App Bar on standard resolution displays |
appLogo_2x.png | 320 x 80 (Maximum size) |
320 x 80 (Maximum size, Leave some vertical margin) |
App Bar on high resolution displays |
*Image sizes are in pixels
**High resolution displays include MacBookPro with Retina Display
Update content for a new version
The Splunk Enterprise appserver caches all static assets in your app, such as images, CSS and Javascript. If you release a new version of your app, you can set app.conf
to make your updated assets available to users. Add the install
stanza attribute to your app.conf
file, and specify a build number. For example:
[install] build = 2
- The stanza must have the
[install]
header. - Set the build number to a unique ID. This way, when someones installs a new version of the app, they get the new assets you package with your app.
Inputs
Configure inputs for your app. Do you want to index a specific type of data just for your app? For example, you may just want to index your Web logs so your Web developers can look at them in one place -- your Web app. Read more about getting data into Splunk Enterprise in the Getting Data In manual.
Indexes
Configure custom indexes to store the data for your app. This is the best way to make sure your app users can only search through specific data. Learn more about how to set up multiple indexes in the Admin manual.
Props and transforms
There are rules for processing most data types. But if you have a custom data type you can set segmentation, character set or other custom data processing rules. Create rules for data processing in props.conf and link it to your data via transforms.conf. You can package these configurations with your app, but they will be applied on a source, sourcetype or host basis. Learn more about how data processing rules work in the Getting Data In manual.
Users and roles
You can create a custom user or role to access your app and the content within your app. This is a good way to restrict different teams to different content. Learn more About users and roles in the Admin Manual.
PREVIOUS Step 2: Create your app |
NEXT Step 4: Add objects |
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11
Feedback submitted, thanks!