Splunk is a search engine and analytic environment that uses a distributed map-reduce architecture to efficiently index, search and process large time-varying data sets.
If you index less than 500M of data per day, Splunk is free to use, and the license never expires with certain functional limitations after the 60 day enterprise trial period. This limit refers to the amount of new data you can add per day, but you can keep adding more and more data every day, storing as much as you want. You could add 500MB of data per day and eventually have 10TB of data in Splunk. Splunk will track and provide notices for each day you exceed the maximum peak daily volume. For free and enterprise trial users the daily limit is 500MB. If the use above Max Peak Daily Volume is exceeded more than 5 times in a rolling 30 day period, the search functionality ceases working.
When your trial license expires, you will automatically be moved to a Splunk free license. If you require more capabilities once your trial has expired please email us
When your dev trial license expires, you can request a developer trial license renewal
If you require more data than the 500MB per day allotted by the free trial please email us
You can join our Splunk Dev Google Group
The Splunk App Framework resides within Splunk's webserver and enables you to customize the Splunk Web UI that comes with the product and build Splunk apps that use the Splunk web server. The Splunk SDKs are designed to enable you to build applications from the ground up and not require Splunk Web or any components from the Splunk App Framework. The Splunk App Framework is part of the features and functionality of the Splunk Software and using those features and functionality there is no modification to the Splunk Software licensed to you. The SDKs are separately licensed to you from the Splunk Software and does not modify the Splunk Software.
Unless otherwise mentioned, it is assumed that this documentation applies only to the most current publicly available version of Splunk. Check the Splunk documentation or download Splunk to verify what the most current version is.
The Splunk SDKs are hosted on GitHub
You can learn more about GitHub here
A Preview release is released "as-is" without support. Generally speaking a Preview release may or may not be feature complete. An Open Beta release is, generally speaking, feature complete and is supported if you are covered under a support agreement. See more details in the "Are Splunk SDKs Supported?" question
If you are covered under an existing maintenance agreement, you will have support if the SDKs are in a beta release or higher and you haven't modified the SDK library.
The Splunk App Framework offers developers a robust tool chain on both the server and client, facilitating interactions between users and Splunk searches, results, configurations, etc.
This is the same framework that powers the Splunk Web interface used by thousands of people every day.
Developers should use the Splunk App Framework if they are looking to create Splunk Apps, which are customizations or extensions of Splunk Web.
In the Splunk world, a Splunk app is something that will run within the Splunk App Framework. A custom application is one that is built using the Splunk SDKs and REST API.
Please refer to this documentation's terminology overview for definitions and disambiguation between apps, add-ons, modules, and views.
The Splunk App Framework runs within CherryPy, a pythonic, object-oriented application server embedded in Splunk on most platforms.
Having an embedded application server facilitates both portability as well as rapid development cycles.
The Splunk App Framework documentation includes a list of known framework issues.
The Splunk App Framework documentation includes App development best practices.