Splunk® Enterprise

Module System User Manual

Splunk Enterprise version 7.3 is no longer supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Environment setup

Important notice: As part of Advanced XML deprecation, the Module System is officially deprecated beginning with Splunk Enterprise 6.3. For more information, see Advanced XML Deprecation.

About the Splunk installation

To develop, test and run custom applications, you need to install Splunk. There are no special installation requirements for app development so, if this is your first exposure to Splunk, refer to the Installation Manual for installing and running Splunk.

You'll find the following Installation Manual sections helpful:

Developing custom applications that use the Module System requires little more than installing Splunk and using your favorite Web development tools to create and debug your application.

Module System applications are implemented using Python and Mako templates, which are packaged with the Splunk distribution, and JavaScript. This toolset should be generally familiar to Web developers. The following figure shows how the Module System abstracts Splunk core, showing component dependencies:

FworkLayersNew.png

The Module System layer API provides the abstractions needed to extend core Splunk functionality, and customize that functionality for your application domain. The framework API provides access to the same libraries that power Splunk Web, including CherryPy application server access and Mako templating facilities. The API also abstracts the REST interface.

Applications built on the Module System typically use the Splunk module pattern and the familiar MVC pattern. These are described in more detail in the Cookbook. For now, you'll learn the parts of an app by walking though a real-world example.

Where to find the code

After installing Splunk, you'll have access to the Module System API source code. This will be useful for debugging and to review for an even better understanding of how the Module System works. The source files of interest are located in the following directories, where Python2.x is the Splunk Python distribution version:

Note: The pathnames are shown for Linux and differ slightly for Windows.

Python controllers $SPLUNK_HOME/lib/Python2.x/site-packages/splunk/appserver/mrsparkle/controllers
Python libraries $SPLUNK_HOME/lib/Python2.x/site-packages/splunk/appserver/mrsparkle/lib
Python model $SPLUNK_HOME/lib/Python2.x/site-packages/splunk/models
Javascript libraries/utilities $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js
Javascript module base classes $SPLUNK_HOME/share/splunk/search_mrsparkle/modules

Your custom app is located in the $SPLUNK_HOME/etc/apps/<yourAppName> directory.

Review the Examples code for the examples used in this document that demonstrate basic app components.

You can also download and install the full set of examples as an app to run the examples from the UI and browse the actual implementation.

  1. Download Dev_tutorial.zip.
  2. Extract the file to your $SPLUNK_HOME/etc/apps directory.
  3. Restart Splunk.
  4. Run the Dev_tutorial app.

Your programming environment

Creating source files

Use your favorite text editor or IDE for app development.

Debugging your application

For client-side debugging of your HTML/CSS/JavaScript, you'll find browser plugins like FireBug to be useful.

Server-side debugging typically involves logging debug messages to the web_services.log file.

Splunk knowledge prerequisites

To successfully develop custom applications, it is helpful to have an understanding of the following topics:

Web programming

  • HTML/CSS
  • Python
  • Javascript
  • and eventually, Mako templates

Splunk

  • Understand Advanced XML, particularly, module hierarchy and how context is passed between modules. Download and run the UI Examples tutorial: Splunk UI examples app for 4.1+)
  • Understand application UI behavior as implemented by the ViewController class in view.py:

    Windows: 

    $SPLUNK_HOME\Python-2.x\Lib\site-packages\splunk\appserver\mrsparkle\controllers\view.py
    Linux: 
    $SPLUNK_HOME/lib/Python2.x/site-packages/splunk/appserver/mrsparkle/controllers/view.py

  • Understand structure and behavior of modules that make up a view, as implemented by: module.py:

    Windows:

    $SPLUNK_HOME\Python-2.x\Lib\site-packages\splunk\appserver\mrsparkle\lib\module.py
    Linux:
    $SPLUNK_HOME/lib/Python2.x/site-packages/splunk/appserver/mrsparkle/lib/module.py

Last modified on 12 August, 2019
Module Reference   Anatomy of an app

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters