Developing or creating a simple Splunk application is very easy in Splunk Enterprise, but developing a Splunk app that solves a business problem specific to a use case requires the following basic process:
A Splunk app can include various components of Splunk Enterprise, such as data inputs, search queries, custom dashboards, macros, custom CSS, JavaScript, and many more…
The Splunk application framework works on a directory structure. All the installed and, by default, available applications are available at $SPLUNK_HOMEetcapps
.
The following procedure needs to be followed to create a sample Splunk app via the Splunk Web console which is accessible via http://localhost:8000
(this address needs to be replaced with the IP address and configured port number of the Splunk instance in case it is not accessed from the Splunk Server machine.)
The procedure to create a Splunk application and Splunk technology add-ons is almost same with just a small difference in one step. The change will be highlighted in the following steps:
$SPLUNK_HOMEetcapp
. The folder name cannot have a dot (.
) character in its name. Even though users are free to keep any name for the add-on, Splunk recommends you to use TA-
as a prefix to the name of the add-on folder so as to uniquely differentiate Splunk applications and add-ons.Sample_app
and Barebones
. The Barebones
template provides a sample app directory structure, whereas Sample_app
includes sample views and saved searches. In the case of a technology add-on, this is not applicable as there are no visible UIs.For the application to be visible in the app list of Splunk, it is required that the Splunk instance is restarted.
Now, users can navigate to the Splunk application that we created and start creating custom dashboards, visualizations, and alerts that we will be studying in the upcoming chapters in this book.
Our Splunk app needs to be packed properly so that it can be redistributed to other users working on Splunk deployment. There is a specific set of instructions that needs to be followed and the app needs to be made compliant to all the instructions so that we are able to upload the Splunk app on the Splunk app store. However, making the Splunk application compliant with the Splunk app store is out of the scope of this book.
The following is the easiest and simplest method to package the Splunk app in order to install it on other Splunk deployments:
$SPLUNK_HOMEetcapp
directory on the Splunk Server and copy the Application
folder to another path, say, your desktop. The folder name is the same that the user specified in the preceding section while creating the application.$SPLUNK_HOMEetcapp
is TestApplication
..zip
or .tar.gz
file. In our case, the application after compression will become TestApplication.zip
or TestApplication.tar.gz
.TestApplication.zip
or TestApplication.tar.gz
) is ready for redistribution and can be installed on other Splunk deployments that are running on the compatible version of Splunk.Installing the Splunk app via a web interface is very simple. The following steps are required for the installation of the Splunk app:
In deployments where the access to Splunk Web is not enabled or the user wants to manually install the application, the following procedure is to be followed:
TestApplication.zip
or TestApplication.tar.gz
) using any decompressing tool such as 7Zip.default
, local
, and others.$SPLUNK_HOMEetcapp
, making sure that the folder copied is the root folder of the application.For example, in our case, the application folder path will look like $SPLUNK_HOMEetcappTestApplication
.
Yes, copying the application folder to the respective app directory and then restarting the Splunk Server installs the application on Splunk. On every restart, the Splunk Server refreshes its app list and the newly added application gets listed on the Splunk app list.
The Splunk application can be installed or updated from the command line as well. Open Command Prompt in Windows or a terminal in a Linux system and traverse to $SPLUNK_HOMEin
.
Then, run the following command to install the application for Windows users:
splunk install app <app_package_filename> -update 1 -auth <username>:<password>
For Linux users, run the following command:
./splunk install app <app_package_filename> -update 1 -auth <username>:<password>
After running this command, restart Splunk Enterprise to let the changes take effect.
18.220.136.165