Installation Manual

Changes for Splunk App developers

If you develop apps for the Splunk platform, read this topic to find out what changes we've made to how the software works with apps in version 6.3, and how to migrate any existing apps to work with the new version.

Advanced XML has been deprecated

The Advanced XML feature of the Splunk Web Framework has been deprecated. This means that there will be no further development of the feature, and support for it can be removed in a future version of the Splunk software.

While Advanced XML will no longer get feature enhancements, it remains supported and Splunk will fix any bugs that developers or customers encounter. Dashboards that use Advanced XML features will also continue to work.

Developers should begin using other features of the Splunk Web Framework, such as HTML, Simple XML, and Simple XML jS/CSS extensions to build their views or apps.

See "Advanced XML Deprecation" in the Developing Views and Apps for Splunk Web manual.

Django Web Framework bindings have been deprecated

In an effort to simplify the guidance on how to build user interface components for Splunk platform apps, the use of Django in our User Interface framework has been deprecated. This means that there will be no further development of the feature, and support for it can be removed in a future version of the Splunk software.

While Django bindings will no longer get feature enhancements, it remains supported and Splunk will fix any bugs that developers or customers encounter.

Developers should begin using the Simple XML or HTML features in combination with SplunkJS as an alternative to Django in the process of building their app UI components. See "[Splunk Web Framework Overview]" on the Splunk Developer Portal for information on the available features in the Splunk Web Framework.

Some elements of Simple XML have been deprecated

A number of the elements of Simple XML have been deprecated, including:

• The <seed> element within the form input type: Use the <initialValue> element instead. <seed> will still be supported for compatibility, but reference to it in the docs will be removed.
• The previewResults <option> argument. The searchTemplate element, which has also been deprecated, supported this argument.
• The charting.axisLabelsY.majorLabelVisibility and charting.axisLabelY.majorTickSizeattributes for the <chart> element.
• The following attributes for the <single> element:
  • additionalClass
  • classField
  • beforeLabel
  • afterLabel

While these elements continue to be supported, no further development on them will occur, and they can be removed from the Splunk software in a future release.

Several advanced features to Simple XML dashboard framework have been added

There were several advanced features added to Simple XML in 6.3, including:

• Link list form input
• Search Result Token Setter - allows you to set tokens based on available metadata from the search, job, and even 1st search result.
  • Bind to search event handlers (progress, preview, done, finalized, cancelled, error, fail)
  • Set/unset/eval tokens based on search or job metadata, as well as the first result set
• Eval expressions support for token setting and match conditions

The single value visualization has been updated

Single value visualization has been significantly updated to include better number formatting, a sparkline, trend indicator, as well as better color controls. Note that with this redesign, there are also several options that have been deprecated.

Review and update any dashboard that uses this visualization.

New geospatial visualization: choropleth maps

You can use choropleth maps to map a numeric or string based field across a geographic region. This allows you to spot patterns and quickly get a sense of the spatial fingerprint for your data.

Built-in polygon definitions for countries or the world as well as the 50 states of the US have been packaged. You can also upload your own polygon definitions in KMZ format.

Apps no longer must restart splunkd after installation of app components

Beginning with version 6.3, if your app has custom controllers, modules, or other components, and contains a web.conf file, it no longer needs to restart splunkd in order to install those components. The software now reloads the configuration instead.

The "Run a script" alert action has been replaced with the custom alert actions framework

If you develop apps with alerts that trigger an action, such as the running of a script, the available alert action options expand when you upgrade the Splunk software to version 6.3.

This version of the software comes with a custom framework that you can use to run scripts or perform other actions when an alert fires.

See "Custom alert actions overview" in the Developing Apps and Views for Splunk Web manual for additional information about the new feature.

Server-side caching of static assets has been enabled

Splunk Enterprise now caches static assets (items that are located in the appserver/static directory within an app) on the server. This means that, as a developer, you must clear the server cache as well as the browser cache to see any change in those assets on a Splunk software instance.

If you are in a dedicated development environment, you can configure the web.conf in your app to disable server-side caching of these assets.

For more information, see Clear client and server assets caches after customization in Developing Views and Apps for Splunk Web.

A method to send data to Splunk Enterprise over HTTP (the HTTP Event Collector) has been introduced

Splunk developers can now send data to Splunk indexers without the need for a forwarder.

The Introduction to Splunk HTTP Event Collector provides additional information about this new feature and how to develop for it.

App Key Value Store has been improved

Several improvements to the App Key Value Store feature have been made.

Improvements include an increase in performance, added support for distributed search-based lookups in the indexing tier, support for automatic lookups, and improvements to lookups like adding the ability to use filters and queries.

For more information, see "Manage state with the App Key Value Store" on the Splunk Developer Portal.

Developer Guidance has been expanded

Developer case studies to our Developer Guidance have been added in an effort to increase developer proficiency of the technologies that power the Splunk Enterprise product. For details on what has changed, see "Developer Guidance" in the Splunk Developer Portal.