Build Splunk apps

What is a Splunk App?

A Splunk App is a prebuilt collection of dashboards, panels and UI elements powered by saved searches and packaged for a specific technology or use case to make Splunk immediately useful and relevant to different roles. As an alternative to using Splunk for searching and exploring, you can use Splunk Apps to gain the specific insights you need from your machine data. You can also apply user/role based permissions and access controls to Splunk Apps, thus providing a level of control when you are deploying and sharing Apps across your organization. Apps can be opened from the Splunk Enterprise Home Page, from the App menu, or from the Apps section of Settings.

What is a Splunk Add-On?

An Add-On is typically a single component that you can develop that can be re-used across a number of different use cases and bundled with one or more Splunk Apps. Examples of a Splunk Add-On include:

  • a custom search command
  • a modular input
  • a data model definition
  • a custom rest endpoint
  • custom field extractions, sourcetype definitions or macros
  • reusable javascript/CSS

How to Build a Splunk App

The Splunk Web Framework makes building a Splunk App look and feel like building any modern web application.

The Dashboard Editor makes it easy to build interactive dashboards and user workflows as well as add custom styling, behavior, and visualizations in Simple XML, which is ideal for fast, lightweight app customization and building. Simple XML development requires minimal coding knowledge and is well suited for Splunk power users in IT to get fast visualization and analytics from their machine data. Simple XML also lets the developer convert the dashboard to HTML with one click to do more powerful customization and integration with JavaScript.

Developers looking for more advanced functionality and capabilities can build Splunk apps from the ground up using popular, standards-based web technologies: JavaScript and Django. The Splunk Web Framework lets developers quickly create Splunk Apps by using prebuilt components, styles, templates, and reusable samples as well as supporting the development of custom logic, interactions, components, and UI. Developers can choose to program their Splunk app using Simple XML, JavaScript, or Django (or any combination thereof).

>  To learn more, read about the Splunk Web Framework.

>  Download and share apps on Splunk > Apps.

>  For information about developing Splunk Apps with the legacy Advanced XML Framework, see the Module System User Manual.