Splunk Developer FAQs

In addition to these frequently asked questions about Splunkbase, visit Splunk Answers or send us an email




Web Framework


  1. What is Splunk?

    Splunk Inc. provides the platform for machine data. Splunk software collects, indexes and harnesses machine-generated big data from websites, applications, servers, networks, sensors and mobile devices that power business. Splunk software enables organizations to act on real-time and historical machine data. Splunk software is a search engine and analytic environment that uses a distributed map-reduce architecture to efficiently index, search and process large time-varying data sets.

  2. So is Splunk software really free?

    If you index less than 500M of data per day, Splunk Enterprise is free to use, and the license never expires with certain functional limitations after the 60 day enterprise trial period. This limit refers to the amount of new data you can add per day, but you can keep adding more and more data every day, storing as much as you want. You could add 500MB of data per day and eventually have 10TB of data in Splunk. Splunk will track and provide notices for each day you exceed the maximum peak daily volume. For free and enterprise trial users the daily limit is 500MB. If the use above Max Peak Daily Volume is exceeded more than 5 times in a rolling 30 day period, the search functionality ceases working.

  3. My free enterprise trial license has expired. How can I continue to use Splunk Enterprise?

    When your trial license expires, you will automatically be moved to a Splunk free license. If you require more capabilities once your trial has expired please email us

  4. My dev trial license has expired. How can I renew my developer trial license?

    When your dev trial license expires, you can request a developer trial license renewal

  5. I need more than the 500MB per day that is allowed by the enterprise trial. How can I increase the upper limit?

    If you require more data than the 500MB per day allotted by the free trial please email us

  6. Where can I connect with other developers building applications on Splunk?

    You can join our Splunk Dev Google Group

  7. What is the difference between the Splunk App Framework and the Splunk SDKs?

    The Splunk App Framework resides within Splunk's webserver and enables you to customize the Splunk Web UI that comes with the product and build Splunk apps that use the Splunk web server. The Splunk SDKs are designed to enable you to build applications from the ground up and not require Splunk Web or any components from the Splunk App Framework. The Splunk App Framework is part of the features and functionality of the Splunk Software and using those features and functionality there is no modification to the Splunk Software licensed to you. The SDKs are separately licensed to you from the Splunk Software and does not modify the Splunk Software.

  8. What version of Splunk Enterprise does this documentation apply to?

    Unless otherwise mentioned, it is assumed that this documentation applies only to the most current publicly available version of Splunk. Check the Splunk documentation or download Splunk to verify what the most current version is.


  1. What is the install count for my app?

    Install count is a heuristic based on Splunk instances pinging home with information about installed apps. The install count is per unique Splunk instances with your app and a valid release installed.

  2. I am trying to track the number of active installs for my app. Does the app install count have duplicate counts when users update my app or reinstall it in their Splunk instance?

    App updates and reinstallation are not double counted, as the count is incremented per unique Splunk instance.

  3. Why does the number of user leads of my app not match the number of downloads?

    User leads are only provided by users who have consented to provide their contact information to the app publisher when downloading an app. They can choose to opt out by unchecking the I consent to Splunk sharing my contact information with the publisher of this app so I can receive more information about the app directly from the publisher box.

  4. How do I update my app's icon?

    For apps hosted on Splunkbase, the app icon needs to be included within the package. The app icon displayed on Splunkbase is used by the default version selected. For more information, see Icons in the Package and publish a Splunk app topic. For apps hosted externally, the Splunkbase app icon can be managed from the app edit page. However, note that the icons will still need to be included within the package for them to be displayed within Splunk.

  5. I would like to change the app id of my app but keep getting an error when attempting to upload a new version. How do I change the app id of my app?

    Changing the app id is strongly discouraged, as this is merely used to uniquely identify the app within Splunkbase, which is necessary for checking for updates by users as well as tracking download stats. If you still wish to use a new app id, you can upload the package as a new app and request to delete the original app.

  6. How can I change the app owner display name for my app, underneath where it says "Built By"?

    There are two ways you can change the display name for the app author:

    • Create a new account using your company name, and request to transfer ownership.
    • Change the display name of your current account:

      1. Login at https://www.splunk.com/.
      2. Under My Account/My Dashboard, click Edit Login and Email Subscriptions.
      3. Save your changes.
      4. Log out of https://www.splunkbase.com and log back in again to apply the name change update.

  7. I uploaded an app onto Splunkbase but made a minor revision/bug fix that doesn't warrant a new version label. Can I update the app release while keeping the same version number?

    The app needs to have at least one version available as a default. To make changes:

    1. Upload a dummy release with a separate version number.
    2. Set the dummy as the default (must be visible).
    3. Delete the original version.
    4. Upload the updated package with the original version name.
    5. From there, you set the newly uploaded package as '''default''' and delete the dummy.

  8. How do I get access to "leads" for my app?

    Any author/editor of the app should be able to access leads from the app admin tools. Keep in mind that you will only see leads for the downloads where users agreed to share their information. Navigate to "Access download leads", and follow the instructions.

  9. How do I change the background color of my app icon?

    Splunkbase automatically picks the background color from default/data/ui/nav/default.xml in your app package:

    <nav search_view="search" color="#000000">

  10. How do I delete a release?

    1. Log into your Splunkbase account, and navigate to "Manage App" for your app (either from app details page or user page under 'Your Apps').
    2. Click the release you want to delete.
    3. On the bottom right of the "Edit Release" page, click "Delete".

  11. Why doesn't Splunkbase display my app icon?

    Your app is displaying a transparent .png file over a white background (white is the default background color if none is specified). Fix this in one of two ways:

    • You can specify the background color in default/data/ui/nav/default.xml in your app package. For example:<nav search_view="search" color="#000000">
    • You can upload an icon that replaces the transparency with the color of your choice. Learn more.

  12. How do I resolve the error "only one item is allowed in root directory"?

    The error means that the package resulted in more than one file/folder when extracted. This could be the result of the way you packaged the folder. For example: if you packaged from within the folder rather than outside, Splunkbase interprets the file structure of the tarball as having multiple root files/folders despite only resulting in a single folder when extracted.

  13. How do I resolve the error "Hidden files that start with . are not allowed"?

    Some operating systems such as Mac and .DS_Store create a hidden file when using a GUI file manager to browse files. When you package a tarball, omit the hidden files: COPYFILE_DISABLE=1 tar cv --exclude='*DS_Store' $1 > $1.tar

  14. Is my app install count accurate?

    Splunkbase does not count app updates and reinstalls. Splunkbase increments the count per unique Splunk platform instance.

  15. How do I delete my app from Splunkbase?

    Login using admin privileges on your app and click the "Request App Deletion" button at the bottom of the page.

  16. How do I convert my externally hosted directory listing app to one hosted on Splunkbase?

    Login using admin privileges on your app, then click the "Contact Us" link at the bottom of the page.

  17. How can I monetize my app?

    Refer to the "Monetize and license your content" section of the Splunk Answers and Splunkbase manual.

  18. How do I get my app certified?

    Login to your app using admin privileges, navigate to the "Hosting" page, click the "Request Certification" checkbox, and click the "Submit" button.

  19. How do I reset my login password?

    Navigate to https://www.splunk.com/page/sign_up and follow the instructions to reset your password.

  20. How do I create a Splunkbase account?

    Your Splunk.com account works on Splunkbase. To create a splunk.com account, navigate to https://www.splunk.com/page/sign_up and follow the instructions to create an account.

  21. Where can I find information on app packaging and distribution?

    Access the Packaging Toolkit documentation, and navigate to "Package and publish a Splunk app".


  1. Where can I find the Splunk SDKs?

    You can download the Splunk SDKs from here

  2. What is the difference between a Preview SDK and Open Beta SDK release?

    A Preview release is released "as-is" without support. Generally speaking a Preview release may or may not be feature complete. An Open Beta release is, generally speaking, feature complete and is supported if you are covered under a support agreement. See more details in the "Are Splunk SDKs Supported?" question

  3. The SDKs are available as open source. Which license are you using?

    Apache v2.0

  4. Are Splunk SDKs Supported?

    If you are covered under an existing maintenance agreement, you will have support if the SDKs are in a beta release or higher and you haven't modified the SDK library.

Web Framework

  1. What is the Splunk Web Framework?

    The Splunk Web Splunk Web Framework is the full stack that makes building a Splunk app looks and feels like building any modern web application. Developers can build an application, with custom dashboards, charts, form searches and other functionality, using Simple XML, JavaScript and Django.

  2. What do you mean by app, add-on, module, and view?

    Please refer to this documentation's terminology overview for definitions and disambiguation between apps, add-ons, modules, and views.

  3. Is a stand-alone web server required to use the Splunk Web Framework?

    The Splunk Web Framework ships with an embedded application server to facilitate both portability as well as rapid development cycles.