Splunk Inc. provides the platform for machine data. Splunk software collects, indexes and harnesses machine-generated big data from websites, applications, servers, networks, sensors and mobile devices that power business. Splunk software enables organizations to act on real-time and historical machine data. Splunk software is a search engine and analytic environment that uses a distributed map-reduce architecture to efficiently index, search and process large time-varying data sets.
If you index less than 500M of data per day, Splunk Enterprise is free to use, and the license never expires with certain functional limitations after the 60 day enterprise trial period. This limit refers to the amount of new data you can add per day, but you can keep adding more and more data every day, storing as much as you want. You could add 500MB of data per day and eventually have 10TB of data in Splunk. Splunk will track and provide notices for each day you exceed the maximum peak daily volume. For free and enterprise trial users the daily limit is 500MB. If the use above Max Peak Daily Volume is exceeded more than 5 times in a rolling 30 day period, the search functionality ceases working.
When your trial license expires, you will automatically be moved to a Splunk free license. If you require more capabilities once your trial has expired please email us
When your dev trial license expires, you can request a developer trial license renewal
If you require more data than the 500MB per day allotted by the free trial please email us
You can join our Splunk Dev Google Group
The Splunk App Framework resides within Splunk's webserver and enables you to customize the Splunk Web UI that comes with the product and build Splunk apps that use the Splunk web server. The Splunk SDKs are designed to enable you to build applications from the ground up and not require Splunk Web or any components from the Splunk App Framework. The Splunk App Framework is part of the features and functionality of the Splunk Software and using those features and functionality there is no modification to the Splunk Software licensed to you. The SDKs are separately licensed to you from the Splunk Software and does not modify the Splunk Software.
Unless otherwise mentioned, it is assumed that this documentation applies only to the most current publicly available version of Splunk. Check the Splunk documentation or download Splunk to verify what the most current version is.
Install count is a heuristic based on Splunk instances pinging home with information about installed apps. The install count is per unique Splunk instances with your app and a valid release installed.
App updates and reinstallation are not double counted, as the count is incremented per unique Splunk instance.
User leads are only provided by users who have consented to provide their contact information to the app publisher when downloading an app. They can choose to opt out by unchecking the I consent to Splunk sharing my contact information with the publisher of this app so I can receive more information about the app directly from the publisher box.
For apps hosted on Splunkbase, the app icon needs to be included within the package. The app icon displayed on Splunkbase is used by the default version selected. For more information, see Icons in the Package and publish a Splunk app topic. For apps hosted externally, the Splunkbase app icon can be managed from the app edit page. However, note that the icons will still need to be included within the package for them to be displayed within Splunk.
Changing the app id is strongly discouraged, as this is merely used to uniquely identify the app within Splunkbase, which is necessary for checking for updates by users as well as tracking download stats. If you still wish to use a new app id, you can upload the package as a new app and request to delete the original app.
There are two ways you can change the display name for the app author:
Change the display name of your current account:
The app needs to have at least one version available as a default. To make changes:
Any author/editor of the app should be able to access leads from the app admin tools. Keep in mind that you will only see leads for the downloads where users agreed to share their information.
Splunkbase automatically picks the background color from default/data/ui/nav/default.xml in your app package:
<nav search_view="search" color="#000000">
It's not an explicit feature, but you can modify the URL to specify a different username—for example, https://splunkbase.splunk.com/apps/#/author/USERNAME.
You can download the Splunk SDKs from here
A Preview release is released "as-is" without support. Generally speaking a Preview release may or may not be feature complete. An Open Beta release is, generally speaking, feature complete and is supported if you are covered under a support agreement. See more details in the "Are Splunk SDKs Supported?" question
If you are covered under an existing maintenance agreement, you will have support if the SDKs are in a beta release or higher and you haven't modified the SDK library.
Please refer to this documentation's terminology overview for definitions and disambiguation between apps, add-ons, modules, and views.
The Splunk Web Framework ships with an embedded application server to facilitate both portability as well as rapid development cycles.