Getting Started with the App Framework

Introduction

The App Framework is an application server for running Web applications on a Splunk host. The following figure shows how the App Framework abstract Splunk core and provides a higher level of abstraction than the REST API.

The App Framework layer API provides the abstraction needed to easily integrate your application into core Splunk software. The API provides access to the same libraries that power Splunk Web, including the REST API, CherryPy application server, and Mako templating facilities.

What's covered here

This Getting Started tutorial describes how to design, implement and deploy a custom module, which is the core component of any application and the main work in creating a custom application. You are exposed to the fundamentals of framework app development before getting into the details of the many App Framework facilities available to you.

One of the important topics not presented here is how to use the MVC pattern to setup, or dynamically configure, your application. But you can learn about MVC and other advanced topics in the App Framework Cookbook.

For now, we hope to give you a sense of the environment you'll be working in while you learn:

  • How to setup your environment to develop applications using the App Framework.
  • How applications are structured and interact with Splunk core.
  • How to deploy your application.

Prerequisites

To successfully develop custom applications, you need working knowledge of the following topics:

Web programming

  • HTML/CSS
  • Python
  • Javascript
  • and eventually, Mako templates

Splunk

  • Understand Advanced XML (Download and run the tutorial app: Splunk UI examples app for 4.1+)
    Particularly, module hierarchy and how context is passed between modules.
  • Understand application runtime behavior as implemented by view.py. 
    Windows:
$SPLUNK_HOME\Python-2.x\Lib\site-packages\splunk\appserver\mrsparkle\controllers\view.py

Linux:
$SPLUNK_HOME/lib/Python2.x/site-packages/splunk/appserver/mrsparkle/controllers/view.py
  • Understand module structure and behavior as implemented by module.py. 
    Windows:
$SPLUNK_HOME\Python-2.x\Lib\site-packages\splunk\appserver\mrsparkle\lib\module.py

Linux:
$SPLUNK_HOME/lib/Python2.x/site-packages/splunk/appserver/mrsparkle/lib/module.py