Splunk Developer FAQs

You may be wondering about a few things. Check out these frequently asked questions. If these don't cover your questions you can always check Splunk Answers or send us an email




Web Framework


  1. What is Splunk?

    Splunk Inc. provides the platform for machine data. Splunk software collects, indexes and harnesses machine-generated big data from websites, applications, servers, networks, sensors and mobile devices that power business. Splunk software enables organizations to act on real-time and historical machine data. Splunk software is a search engine and analytic environment that uses a distributed map-reduce architecture to efficiently index, search and process large time-varying data sets.

  2. So is Splunk software really free?

    If you index less than 500M of data per day, Splunk Enterprise is free to use, and the license never expires with certain functional limitations after the 60 day enterprise trial period. This limit refers to the amount of new data you can add per day, but you can keep adding more and more data every day, storing as much as you want. You could add 500MB of data per day and eventually have 10TB of data in Splunk. Splunk will track and provide notices for each day you exceed the maximum peak daily volume. For free and enterprise trial users the daily limit is 500MB. If the use above Max Peak Daily Volume is exceeded more than 5 times in a rolling 30 day period, the search functionality ceases working.

  3. My free enterprise trial license has expired. How can I continue to use Splunk Enterprise?

    When your trial license expires, you will automatically be moved to a Splunk free license. If you require more capabilities once your trial has expired please email us

  4. My dev trial license has expired. How can I renew my developer trial license?

    When your dev trial license expires, you can request a developer trial license renewal

  5. I need more than the 500MB per day that is allowed by the enterprise trial. How can I increase the upper limit?

    If you require more data than the 500MB per day allotted by the free trial please email us

  6. Where can I connect with other developers building applications on Splunk?

    You can join our Splunk Dev Google Group

  7. What is the difference between the Splunk App Framework and the Splunk SDKs?

    The Splunk App Framework resides within Splunk's webserver and enables you to customize the Splunk Web UI that comes with the product and build Splunk apps that use the Splunk web server. The Splunk SDKs are designed to enable you to build applications from the ground up and not require Splunk Web or any components from the Splunk App Framework. The Splunk App Framework is part of the features and functionality of the Splunk Software and using those features and functionality there is no modification to the Splunk Software licensed to you. The SDKs are separately licensed to you from the Splunk Software and does not modify the Splunk Software.

  8. What version of Splunk Enterprise does this documentation apply to?

    Unless otherwise mentioned, it is assumed that this documentation applies only to the most current publicly available version of Splunk. Check the Splunk documentation or download Splunk to verify what the most current version is.


  1. What is the install count for my app?

    Install count is a heuristic based on Splunk instances pinging home with information about installed apps. The install count is per unique Splunk instances with your app and a valid release installed.

  2. I am trying to track the number of active installs for my app. Does the app install count have duplicate counts when users update my app or reinstall it in their Splunk instance?

    App updates and reinstallation are not double counted, as the count is incremented per unique Splunk instance.

  3. Why does the number of user leads of my app not match the number of downloads?

    User leads are only provided by users who have consented to provide their contact information to the app publisher when downloading an app. They can choose to opt out by unchecking the I consent to Splunk sharing my contact information with the publisher of this app so I can receive more information about the app directly from the publisher box.

  4. How do I update my app's icon?

    For apps hosted on Splunkbase, the app icon needs to be included within the package. The app icon displayed on Splunkbase is used by the default version selected. For more information, see Icons in the Package and publish a Splunk app topic. For apps hosted externally, the Splunkbase app icon can be managed from the app edit page. However, note that the icons will still need to be included within the package for them to be displayed within Splunk.

  5. I would like to change the app id of my app but keep getting an error when attempting to upload a new version. How do I change the app id of my app?

    Changing the app id is strongly discouraged, as this is merely used to uniquely identify the app within Splunkbase, which is necessary for checking for updates by users as well as tracking download stats. If you still wish to use a new app id, you can upload the package as a new app and request to delete the original app.

  6. How can I change the app owner display name for my app, underneath where it says "Built By"?

    There are two ways you can change the display name for the app author:

    • Create a new account using your company name, and request to transfer ownership.
    • Change the display name of your current account:

      1. Login at https://www.splunk.com/.
      2. Under My Account/My Dashboard, click Edit Login and Email Subscriptions.
      3. Save your changes.
      4. Log out of https://www.splunkbase.com and log back in again to apply the name change update.

  7. I uploaded an app onto Splunkbase but made a minor revision/bug fix that doesn't warrant a new version label. Can I update the app release while keeping the same version number?

    The app needs to have at least one version available as a default. To make changes:

    1. Upload a dummy release with a separate version number.
    2. Set the dummy as the default (must be visible).
    3. Delete the original version.
    4. Upload the updated package with the original version name.
    5. From there, you set the newly uploaded package as '''default''' and delete the dummy.

  8. How do I get access to "leads" for my app?

    Any author/editor of the app should be able to access leads from the app admin tools. Keep in mind that you will only see leads for the downloads where users agreed to share their information.

  9. How do I change the background color of my app icon?

    Splunkbase automatically picks the background color from default/data/ui/nav/default.xml in your app package:

    <nav search_view="search" color="#000000">

  10. How do I get access to "leads" for my app?

    It's not an explicit feature, but you can modify the URL to specify a different username—for example, https://splunkbase.splunk.com/apps/#/author/USERNAME.


  1. Where can I find the Splunk SDKs?

    You can download the Splunk SDKs from here

  2. What is the difference between a Preview SDK and Open Beta SDK release?

    A Preview release is released "as-is" without support. Generally speaking a Preview release may or may not be feature complete. An Open Beta release is, generally speaking, feature complete and is supported if you are covered under a support agreement. See more details in the "Are Splunk SDKs Supported?" question

  3. The SDKs are available as open source. Which license are you using?

    Apache v2.0

  4. Are Splunk SDKs Supported?

    If you are covered under an existing maintenance agreement, you will have support if the SDKs are in a beta release or higher and you haven't modified the SDK library.

Web Framework

  1. What is the Splunk Web Framework?

    The Splunk Web Splunk Web Framework is the full stack that makes building a Splunk app looks and feels like building any modern web application. Developers can build an application, with custom dashboards, charts, form searches and other functionality, using Simple XML, JavaScript and Django.

  2. What do you mean by app, add-on, module, and view?

    Please refer to this documentation's terminology overview for definitions and disambiguation between apps, add-ons, modules, and views.

  3. Is a stand-alone web server required to use the Splunk Web Framework?

    The Splunk Web Framework ships with an embedded application server to facilitate both portability as well as rapid development cycles.