Get started developing Splunk apps

To get started developing an app or add-on for Splunk Enterprise, you'll need:

  • A Splunk Enterprise test environment.
    Use an installation of Splunk Enterprise on a single-instance development environment, such as a laptop.
  • Development tools.
    Splunk Web has a built-in source code editor with syntax highlighting and auto-indent features, or use your own editor for XML, CSS, and HTML files. You can also use debugging tools that are included with web browsers.
  • A plan for your app.
    Determine the scope of your app and decide on the use case you want to address. Storyboard your app and create mockups of the dashboards, panels, and navigation.
  • Sample data.
    Decide what data you want to work with and how you're going to import it. Get some sample data to test your app.

Here are the basic steps in developing an app:

Step

Description

Create a Splunk app Create the files and directory structure for your app.
Configure the data layer and knowledge objects in a Splunk app Configure data inputs to index and process your data. Create objects for your app such as reports, alerts, field extractions, lookup tables, and so forth.
Set permissions for objects in a Splunk app Set permissions to allow your app users to view and edit knowledge objects to your app. Optionally, add users and create roles for the users you want to access your app.
Use the Splunk Web Framework Create dashboards in XML and/or HTML using the Splunk Web Framework. Add search managers to add searches to your dashboards. Display search results using Splunk views. Define the drilldown behavior for your visualizations.
Manage state with the App Key Value Store Create a Key Value Store collection to manage state and store information for your app.
Create a setup page for a Splunk app If your app requires user input to be configured, add a setup page for users to fill out the first time they run the app.
Add navigation to a Splunk app Build navigation for your app so users can access the dashboards, reports, and other features of your app.
Package and publish a Splunk app Package your app to distribute it to other users. You can also publish your app to Splunkbase, Splunk's community for app developers.