Splunk Web Framework Overview

The Splunk Web Framework is an app framework for Splunk users who want to create custom dashboards and Splunk apps with tables, charts, forms searches, and other functionality. Splunk provides different tools for development, ranging from an easy-to-use GUI with click-and-drag tools to a set of Backbone models for JavaScript developers.

Splunk Web Framework apps

Architecture

The Splunk Web Framework provides a stack of features built on top of splunkd, the core Splunk server. You can build apps that run in Splunk Web alongside apps such as Splunk Search, but you can also build custom apps that interact with Splunk but run on your own web server.

Splunk Web Framework architecture

 

Tools for the Simple XML layer

The Simple XML layer of the stack provides easy-to-use tools that don't require any programming knowledge and are available from the Splunk Web UI:

  • Dashboard Editor
  • The Dashboard Editor is a WYSIWYG click-and-drag interface that allows you to build dashboards within Splunk Web. You can add panels with views such as tables and charts, along with form controls such as dropdown lists, checkboxes, and radio buttons. The Dashboard Editor also provides editing tools that lets you modify the panels, views, and forms.

    Dashboard Editor

  • Simple XML
  • Splunk's extensible markup language, Simple XML, is the underlying source code for the dashboards created using the Dashboard Editor. Although you can work with the most common features using the Dashboard Editor, some features are only available by working in the Simple XML code.
    To edit Simple XML, you can use the Source Editor in Splunk Enterprise, or use your own text editor if you have access to the source files in your Splunk Enterprise installation.

    Simple XML Editor

Tools for the Simple XML Extensions and HTML Dashboard layers

The Simple XML Extensions and HTML Dashboard layers of the stack are for web developers with varying levels of expertise who want to further customize dashboards and apps in a familiar web developer environment. Each layer accesses SplunkJS Stack, which is a web stack of JavaScript and JavaScript libraries, and contains prebuilt components for search managers and visualizations.

  • Simple XML extensions
  • Use extensions to modify the appearance and behavior of a dashboard that was created using the Dashboard Editor or by using Simple XML. Extensions are CSS and JavaScript files that you add to your app then reference from the dashboard's Simple XML code.

  • HTML dashboards
  • For full control over the appearance and behavior of an app, you can convert any dashboard from Simple XML to HTML, then use your favorite development tools to work with CSS, HTML, and JavaScript code to build rich, interactive experiences:

    • Modify all aspects of page layout and UI.
    • Add custom logic, interactions, and drilldown behavior.
    • Interact with Splunk searches and manipulate Splunk data.
    • Create custom visualizations and reusable components.
    • Add third-party visualizations.
    • Use Splunk dashboard styles so that your apps can have the same Splunk look and feel, including Splunk chrome and navigation bars.

    If you don't have access to the source files in your Splunk Enterprise installation, you can edit HTML using the Source Editor in Splunk Enterprise.

  • SplunkJS Stack libraries
  • Integrate Splunk into your own web apps that run on your own web server by adding the SplunkJS Stack libraries to your web site, enabling you to use all of Splunk Web Framework components to interact and view your Splunk data.

 

Getting started

Since the Splunk Web Framework is included with Splunk Enterprise 6 and later, you don't need to download or install anything to get started. The Splunk Web Framework has several components―which ones you use depends on what you want to do, and how much you already know.

Dashboard Editor        Simple XML source code Simple XML extensions HTML dashboards SplunkJS Stack libraries
Use case Create and modify dashboards Add advanced features to existing dashboards Add custom styles and logic to dashboards Create interactive dashboards with custom layouts and visualizations Integrate Splunk components into your own web site applications
Skills None XML • CSS
• HTML
• JavaScript
• CSS
• HTML
• JavaScript
• CSS
• HTML
• JavaScript
Benefits • Drag-and-drop UI
• PDF generation
• Drag-and-drop UI
• PDF generation
• More layout options
• More features
• Drag-and-drop UI
• PDF generation
• Completely customizable
• Third-party libraries
• Completely customizable
• Third-party libraries
• Completely customizable
• Third-party libraries
• Runs outside Splunk Web
Drawbacks • Limited layout
• Limited features
• Limited layout
• Limited features
None • No drag-and-drop UI
• No PDF generation
• No drag-and-drop UI
• No PDF generation
Get Started About the Dashboard Editor About editing Simple XML Modify dashboards using Simple XML extensions Convert Simple XML dashboards to HTML Use SplunkJS Stack in your own web apps

 

Splunk Enterprise Apps

Splunk provides a couple of apps that showcase different features of the Splunk Web Framework to help you get started.

Splunk 6.x Dashboard Examples

Splunk Dashboard Examples App

The Splunk 6.x Dashboard Examples app contains example dashboards and sample code showing you how to use Simple XML for both basic features as well as advanced customizations. Examples range from usage of tables and charts to example Simple XML extensions for customization of layout, visualizations, and interactivity.

Splunk Web Framework Toolkit

Splunk Web Framework Toolkit App

The Splunk Web Framework Toolkit app helps you get familiar with the SplunkJS Stack. The toolkit app includes several custom views that you can use in your own apps, along with code examples and documentation.