Splunk App Examples

The sample SPL2 buttercup games app is a demonstration application designed to showcase SPL2 (Search Processing Language 2) capabilities. It serves as a template for learning how to:

• Organize app modules for customization and reuse.
• Specify custom eval functions.
• Use $SPLUNK_HOME as a variable.
• Utilize dataset literals to provide sample data.
• Import resources (indexes, lookups, functions) into the _resources module.
• Implement base searches to branch into child searches.
• Export views for use in Splunk Web.

Twitted is a sample Splunk application that indexes data from the Twitter stream API. It provides a collection of saved searches to inspect the resulting Twitter data.

This application serves two primary purposes:

1. Provides a readily available data source for learning and exploring Splunk.
2. Demonstrates how to use the Splunk SDK to "push" data into Splunk using a TCP input via a standalone Python script (input.py).

Note: The input.py script is designed to run standalone for experimentation rather than being implemented as a managed Splunk scripted input.

The sample SPL2 pii masking app is an SPL2-based application designed to demonstrate several advanced SPL2 architectural patterns:

• Module Permissions: Learn how to manage permissions on modules to control access to datasets.
• Data Masking Architecture: See how to architect modules to create masked views of datasets for unauthorized users.
• Role-based Execution: Enable specific roles to run views within a module as if they were the module owner.
• Module Organization: Learn how to organize modules for reuse and customization.
• Custom Command Functions: See how to specify a custom function (e.g., pii_mask) to mask sensitive data like employee IDs.
• Dataset Literals: Use dataset literals to provide sample data within the app.
• View Management: Learn how to import views into a _resources module and how to export views.

The customsearchcommands_app demonstrates various base Splunk command types using the Splunk SDK for Python. The available commands are:

A setup page is a specialized page within a Splunk app that appears when users launch the app for the first time. It provides a UI for users to configure app settings directly within Splunk Web.

When to use a setup page:

• Splunk Cloud Platform: Providing a setup page is required for app configuration.
• Splunk Enterprise: Providing a setup page is considered a best practice.

Common Use Cases:

• Saving user configurations into custom .conf files within your app.
• Integrating the app with external services (e.g., calling a third-party API).
• Verifying that required app dependencies are correctly installed.

A modular input is a Splunk app that defines a custom input capability. Once installed, modular inputs are treated as native inputs by the Splunk platform. This allows system administrators and end users to discover, select, and configure them via the Settings > Data inputs page in Splunk Web, just like any other native data input.

Key features include:

• Data Streaming: A script within the app streams data from a source to Splunk.
• Setup UI: Apps can include a user interface for configuration.
• Runtime Controls: Provides mechanisms to control the input during execution.
• Index-time Settings: Allows the input to specify settings on a per-event basis.

Splunk automatically redirects users to a setup page if the is_configured property in the [install] stanza of the app's app.conf is set to false. This mechanism ensures that an administrator or user is prompted to configure the application before it is used.

[install]
is_configured = false

Splunk uses the app.conf configuration file to determine if an application requires initial configuration. If the is_configured property in the [install] stanza is set to 0 (false), Splunk will automatically attempt to redirect the user to the designated setup page upon app installation or access.

To implement this, ensure your app.conf contains the following logic:

1. Set is_configured = 0 in the [install] stanza to trigger the redirect.
2. Define the setup_page property in the [ui] stanza to point to the XML resource (usually a dashboard) that serves as the setup interface.

[install]
is_configured = 0

[ui]
setup_page = default/data/ui/views/setup_page_dashboard.xml

The API Explorer provides a workflow for testing REST API calls:

1. API Selection: Choose an API from the dropdown menu.
2. Form Generation: The tool generates an API-specific form with all required parameters. It performs validation to ensure all required fields are filled.
3. Execution: When an API call is made, the explorer issues the request to the Splunk server.
4. Cross-Domain Handling: To bypass cross-domain (CORS) issues, the tool uses a locally hosted redirect server to route the call to the Splunk server.
5. Response: The server's response is displayed directly in the browser.