How to create a new modular input project using the Splunk extension for Visual Studio

The Splunk® extension for Visual Studio modular input wizard includes the components needed to create a Splunk Enterprise modular input. For more information about creating modular inputs using the Splunk SDK for C# 2.0, see How to create modular inputs.

This topic contains the following sections:

Creating the modular input project

To create a new modular input project:

  1. On the File menu, point to New, and then click Project.

  2. In the left pane of the New Project window, click Installed, Templates, Visual C#, and then Splunk. The two Splunk project types appear.

    Screen shot of the Visual Studio New Project window
  3. Select Splunk Modular Input, and then click OK.

    Screen shot of the New Modular Input dialog box
  4. In the New Modular Input dialog box, enter the following information. (This information corresponds to fields within the app.conf file, which is packaged along with your modular input as part of an .SPL archive to deploy to Splunk Enterprise.)

    1. In the Author field, enter your name. If you intend to publish this modular input to Splunkbase (splunkbase.splunk.com), enter your splunk.com username. This is a required field.

    2. In the Version field, enter a version number. This field is prefilled with "0.1.0," but you can change it to be whatever you want.

    3. In the Label field, enter the name you want to give your modular input. This will be the primary way that users will identify your modular input within Splunk Enterprise. If the App container should be visible in launcher checkbox is selected, then this is the name shown in the Splunk launcher for the created app containing the modular input.

    4. Select the App container should be visible in launcher checkbox if you want this modular input to appear on the Splunk Enterprise launcher screen. By default, this setting is not selected.

    5. In the Description field, enter one line that concisely describes the modular input.

    6. If you want to generate an example implementation, leave the Generate an example implementation checkbox selected. If you want to start from scratch, click the checkbox to leave it unselected.

  5. Click OK.

Your new project's solution opens automatically.

If you left the Generate an example implementation checkbox selected, you will see some basic starter code in the editor window. This code is identical to the random-numbers example within the Splunk SDK for C# 2.0. (For an explanation of what the code does, as well as how to use it to generate a working Splunk Enterprise modular input, see How to create modular inputs in the Splunk SDK for C# 2.0 documentation.) The new project also contains the following:

  • NuGet package references for the Splunk SDK for C# 2.0 and modular input support
  • A modified msbuild file that generates an .SPL file for an app that contains only the modular input defined by the wizard

The created project contains a directory with the same name as the project that holds the app.conf and inputs.conf.spec files, which are the necessary configuration files for building a working .SPL archive. For more information about modular input support in the Splunk SDK for C# 2.0, see How to create modular inputs in the Splunk SDK for C# 2.0 documentation.

Note: If you want to add files to your solution to be built with the modular input—for instance, to create a custom UI or add a logo—you can simply add them to the project directory (the directory with the name of the project that is within the project directory, at the same level as the bin, obj, and Properties directories). When the solution builds, the files will be built with the project, and will also be included in the .SPL file that is created.

If you specified not to generate an example implementation, the editor window contains a class with the necessary methods for a modular input stubbed out. You should add the appropriate logic as described in How to create modular inputs in the Splunk SDK for C# 2.0 documentation. (Though the code stubs will compile, the generated modular input will fail if installed into Splunk Enterprise since it does not yet generate a usable scheme.)

Deploying the modular input

The Splunk extension for Visual Studio makes it easy to deploy the app containing your new modular input to a local Splunk Enterprise instance. When you configure the post-build events described here, the app containing your modular input will be automatically copied to your local Splunk Enterprise instance each time you build it.

Note: To use this feature, you must be running Visual Studio as an administrator. Otherwise the deploy copy function will not work, and will generate errors.

To enable this function, do the following:

  1. With your Visual Studio project (that was created using the modular input template) open, right-click your project's name in the Solution Explorer, and then click Properties.

  2. In the Project Properties window, click Build Events.

  3. Click Edit Post-build, and you'll see the following:

    Screen shot of the Post-build Event Command Line window in Visual Studio
  4. In the Post-build Event Command Line window, remove REM from the REM goto Deploy line, so that it just reads as follows:

    goto Deploy
  5. Ensure that the %SPLUNK_HOME% environment variable is configured on your local machine, or update the script manually to point to the location to which you want to deploy the app. (For instructions about how to update the %SPLUNK_HOME% environment variable, see Environment variables.)

  6. Click OK, and then save and build the project.

Once the modular input has built, look at the output window. You'll see that the app has been deployed and built to the appropriate location.