![]()
Splunk Developer's Guide Second Edition
![]()
Table of Contents
Splunk Developer's Guide Second Edition
Credits
About the Author
About the Reviewer
www.PacktPub.com
Support files, eBooks, discount offers, and more
Why subscribe?
Free access for Packt account holders
Instant updates on new Packt books
Preface
Overview of what this book isn't
What this book is
Assumptions
What this book covers
What you need for this book
Who this book is for
Conventions
Reader feedback
Customer support
Downloading the example code
Errata
Piracy
Questions
1. Application Design Fundamentals
What is a Splunk application?
Why applications?
Definitions
Designing the App
Identifying the use case
Identifying what you want to consume
Identifying what you want to brand
Identifying what you want to display
Installing Apps
Splunk Web
The Splunk command line
Unzipping using the command line
Summary
2. Creating Applications
A brief clarification
Methods of creating applications
GUI
CLI
FreeForm
Basic application structure
appserver
bin
default
local
lookups
metadata
static
Application data
Indexes
Source types
Sources
Available Splunk knowledge objects
Macros
Event types
Tags
Saved searches
Dashboards
Lookups
Configurations
Object permissions
The setup screen
The endpoint
The setup file
Summary
3. Enhancing Applications
Workflows
Custom alert actions
Enriched data
Event types
Tags
Macros
Lookups
Common Information Model
Branding your App
Logos
Navigation
CSS
JavaScript
Acceleration
Summary indexing
Accelerated reports
Summary
4. Basic Views and Dashboards
Knowing your data
Available modules
SimpleXML dashboard
SimpleXML forms
Custom JavaScript, CSS, and Tokens
HTML dashboards
Summary
5. The Splunk Web Framework
The HTML dashboard
SplunkJS Stack
Search-related modules
SearchManager
SavedSearchManager
PostProcessManager
View-related modules
ChartView
The different types of ChartView
Area
Bar
Column
Filler gauge
Line
Marker gauge
Pie chart
Radial gauge
Scatter
Display-related modules
CheckboxView
CheckboxGroupView
DropdownView
EventsViewerView
FooterView
HeaderView
MultiDropdownView
RadioGroupView
SearchBarView
SearchControlsView
SimpleSplunkView
SingleView
MapElement
TableView
TextInputView
TimeRangeView
TimelineView
Tokenization
Customizing Splunk dashboards using CSS
Customizing Splunk dashboards using JavaScript
Custom D3 visualization
External data and content
Data
Content
Summary
6. Advanced Integrations and Development
Modular D3 visualization
Modular inputs
The spec file
Testing modular inputs
Configuring modular inputs
The App Key Value Store
When would you use the KV Store?
Configuring the KV Store
Data models
Version control and package managers
npm
Bower
Gulp
Git
Tying them all together
Summary
7. Packaging Applications
Naming guidelines
Dos and don'ts
Packaging the App
The App packaging checklist
Summary
8. Publishing Applications
Self-hosting your App
Splunkbase
Certified Applications
Splunk Cloud applications
Community
Answers
dev.splunk.com
Internet Relay Chat
Wiki
User groups
The SplunkTrust
Summary
Index
![]()
Splunk Developer's Guide Second Edition
Copyright © 2016 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.
First published: May 2015
Second edition: January 2016
Production reference: 1190116
Published by Packt Publishing Ltd.
Livery Place
35 Livery Street
Birmingham B3 2PB, UK.
ISBN 978-1-78588-237-1
www.packtpub.com
![]()
Author
Kyle Smith
Reviewer
Marco Scala
Commissioning Editor
Veena Pagare
Acquisition Editor
Vinay Argekar
Content Development Editor
Amey Varangaonkar
Technical Editor
Taabish Khan
Copy Editor
Trishya Hajare
Project Coordinator
Suzanne Coutinho
Proofreader
Safis Editing
Indexer
Hemangini Bari
Graphics
Abhinash Sahu
Production Coordinator
Shantanu N. Zagade
Cover Work
Shantanu N. Zagade
![]()
Kyle Smith is a self-proclaimed geek and has been working with Splunk extensively since 2010. He enjoys integrating Splunk with new sources of data and types of visualization. He has spoken numerous times at the Splunk User Conference (most recently in 2014 on Lesser Known Search Commands) and is an active contributor to the Splunk Answers community and also to the #splunk IRC channel. He was awarded membership into the SplunkTrust as a founding member. He has published several Splunk Apps and add-ons to Splunkbase, the Splunk community's premier Apps and add-ons platform. He has worked in both higher education and private industry; he is currently working as an integration developer for Splunk's longest running professional services partner. He lives in central Pennsylvania with his family.
![]()
Marco Scala has been working for more than 15 years delivering solutions to large enterprise customers, first in the APM and J2EE fields and, since 2009, in the fields of operational intelligence and Splunk. He has provided consultancy for big Splunk installations for major customers, focusing on the best and most effective solutions for each different customer's needs. Since 2012, he's also a certified Splunk trainer.
In the last few years, Marco's major focus has been to get Splunk customers to gain the maximum value from their IT data and provide the business a better view and insight. Big Data is another major field of interest, and his next challenge is using Splunk ...
