Testing your app
|Important notice: As part of Advanced XML deprecation, the Module System is officially deprecated beginning with Splunk Enterprise 6.3. For more information, see Advanced XML Deprecation.|
Packaging and Installing
While creating your app, you'll want to test it.
You can either follow along by viewing the code in the /Dev_tutorial directory, or create a new directory parallel and populate it with the Source code for a more hands-on experience.
Typically, you would download an app from Splunk Apps using the Manage apps option of the App menu or create a local .spl file, where the app would be installed in the $SPLUNK_HOME/etc/apps directory. For demonstration purposes and initial debugging before your app is available on Splunk Apps, it is easier to manually install the app, as described in this section.
Your example app should have the following directory structure, located in the $SPLUNK_HOME/etc/apps/<yourApp> directory:
- In $SPLUNK_HOME/etc/apps create a parallel directory to the Dev_tutorial directory, giving it the name of your app.
- For your new app, create the directories shown in the figure, above.
- Populate the directories with the example Source code files. Your app is now ready to run.
- Restart Splunk: ./splunk restart
Note: You can also compress your app in a tarball file with a .spl extension and use the App Manager to install your app.
Running the app
Run the Dev_tutorial app the same way you would run any other Splunk app:
- Start splunkWeb and, if needed, login.
- Click the App drop-down menu and select the Module System Tutorial app.
- Click the Examples drop-down menu in the upper-left and select the example you want to run. For Getting started, select Example: Using a Custom Module
Note: Make sure your app status is enabled.
Debugging on your local machine, you can conveniently change your app code, in $SPLUNK_HOME/etc/apps/Dev_tutorial, and rerun your app.
The way you restart your app depends on what code you changed. If you changed only client-side code, it is sufficient to upgrade the version number, using _bump, and re-run your app:
Note: Make sure you clear the browser cache before re-running your app.
If you made changes to your XML files and need to reload configuration data, use debug/refresh in addition to _bump to refresh all EAI handlers that support reload:
If you changed server-side code, you need to restart Splunk and SplunkWeb:
- On the command line, type splunk restart.
- Login to SplunkWeb.
- Start Module System Tutorial from the App menu.
Note: Use console.debug("Your debug message"); to log messages to your debugger console.
On the server, you can use the built-in Python logging facilities for debugging.
logger = logging.getLogger('splunk.module.CustomResultsTable')
You can enable debug logging, as described in Enable debug logging, and use the debug logging level:
logger.debug('your debug message')
For simple printf-style debugging, you'll find it easier to use the info logging level:
logger.info('your informative message')
Informative messages are logged in the $SPLUNK_HOME/var/log/splunk/web_service.log file.
You'll find most error messages, including Python execution errors, in the log file:
Anatomy of an app
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5