SFBA Splunk User Group Meeting February 2023: Splunk Apps Overview

1. © 2023 SPLUNK INC.
Splunk Apps
Overview
San Francisco Bay Area User Group
Feb 15 2023
Mayur Pipaliya
Sr. Manager FDSE | Splunk Inc.
Sandeep Vasani
Sr. Engineer FDSE | Splunk Inc

2. This presentation may contain forward-looking statements regarding future events, plans or the
expected financial performance of our company, including our expectations regarding our products,
technology, strategy, customers, markets, acquisitions and investments. These statements reflect
management’s current expectations, estimates and assumptions based on the information currently
available to us. These forward-looking statements are not guarantees of future performance and
involve significant risks, uncertainties and other factors that may cause our actual results,
performance or achievements to be materially different from results, performance or achievements
expressed or implied by the forward-looking statements contained in this presentation.
For additional information about factors that could cause actual results to differ materially from those
described in the forward-looking statements made in this presentation, please refer to our periodic
reports and other filings with the SEC, including the risk factors identified in our most recent quarterly
reports on Form 10-Q and annual reports on Form 10-K, copies of which may be obtained by visiting
the Splunk Investor Relations website at www.investors.splunk.com or the SEC's website at
www.sec.gov. The forward-looking statements made in this presentation are made as of the time and
date of this presentation. If reviewed after the initial presentation, even if made available by us, on our
website or otherwise, it may not contain current or accurate information. We disclaim any obligation to
update or revise any forward-looking statement based on new information, future events or otherwise,
except as required by applicable law.
In addition, any information about our roadmap outlines our general product direction and is subject to
change at any time without notice. It is for informational purposes only and shall not be incorporated
into any contract or other commitment. We undertake no obligation either to develop the features or
functionalities described, in beta or in preview (used interchangeably), or to include any such feature
or functionality in a future release.
Splunk, Splunk> and Turn Data Into Doing are trademarks and registered trademarks of Splunk Inc. in the United States and other countries.
All other brand names, product names or trademarks belong to their respective owners. © 2023 Splunk Inc. All rights reserved.
Forward-
Looking
Statements
03.10.22-15:28

3. © 2023 SPLUNK INC.
$ id _
Sr. Manager | FDSE
Mayur Pipaliya
Sr. Software Engineer | FDSE
Sandeep Vasani

4. © 2023 SPLUNK INC.
Agenda 1) What are Splunk Apps
– Splunk Enterprise and Splunk Cloud
2) Type of Splunk Apps
– Apps, Addons
3) Ways to build Splunk Addons
– Technology Addons (TA): Modular Input or Modular
Alert
4) Packaging and vetting
– CLIs, API’s
5) Q/A
– Questions

5. © 2023 SPLUNK INC.
Overall Apps Ecosystem
O11y Connectors
SOAR
Connectors
Splunk
Enterprise /
Cloud Apps
EP / EH

6. © 2023 SPLUNK INC.
What are Splunk Apps?
Packaged sets of configuration that extends the functionality of Splunk Platforms.
May contain:
● Data Input
● Parsing configs
● Custom Search Commands
● Alert Actions
● Custom Visualization
● Dashboards
● Pre-built Reports
Applies to Splunk Enterprise & Cloud

7. © 2023 SPLUNK INC.
Type of Splunk Apps
●Addons
○ Modular Inputs (GDI)
○ Parsing Configurations (CIM, Field Extractions)
●Apps
○ Modular Alert Action (GDO)
○ Custom Search Commands (MapReduce)
○ Custom Visualization (or Splunk UI Component)
○ Dashboards/Reports (UI)
○ Hybrid Apps (such as ES, ITSI)

8. © 2023 SPLUNK INC.
Types of Custom Search Commands
Types
● Generating
○ inputlookups, makeresults
● Streaming
○ Distributed
■ eval, where, field
○ Non Distributed/Centralized
■ head, streamstats
● Transforming
○ stats, timechart, chart
● Eventing/Dataset Processing
○ sort, dedup
Native ones written in C++, and custom ones can be written in Python

9. © 2023 SPLUNK INC.
Ways to Build Splunk Addons
● UCC Framework
○ Universal Configuration Console
○ Framework to generate UI based Splunk Addons.
○ Best for experienced developer. Provides more control over building.
● Addon Builder
○ Modular Inputs or Alerts
○ Parsing Configurations(CIM, Field Extractions)
○ Uses the UCC framework internally. But doesn’t expose all the features of UCC framework.
○ Limited UI options.
○ Best for simple addons.
Technology Addons (TA): Modular Input or Modular Alert

10. © 2023 SPLUNK INC.

11. © 2023 SPLUNK INC.

12. © 2023 SPLUNK INC.

13. © 2023 SPLUNK INC.

14. © 2023 SPLUNK INC.

15. © 2023 SPLUNK INC.
App Packaging
○ Manually
○ Splunk Enterprise CLI command
○ Splunk Packaging toolkit
$ tar cvzf TA-sample-addon-for-splunk.tar.gz –disable-copyfile –exculde “local.meta” –exclude “.DS_Store” –exclude .git/ –exclude
“.gitignore” –exclude local/ –exclude __pycache__/ “TA-sample-addon-for-splunk”
$ splunk package app <appname>
$ slim package [-h] [--debug] [--quiet] [-o <output-dir>] [-r <repository>] [-u <level>] <app-source>

16. © 2023 SPLUNK INC.
App Vetting
○ Splunk Appinspect CLI
○ Splunk AppInspect API
splunk-appinspect inspect filepath/<APP-PACKAGE> --mode precert --included-tags cloud
curl -X POST
-H "Authorization: bearer <TOKEN>"
-H "Cache-Control: no-cache"
-F "app_package=@"/<PATH/APP-PACKAGE>""
-F "included_tags=cloud"
--url "https://appinspect.splunk.com/v1/app/validate"

17. © 2023 SPLUNK INC.
Resources
http://dev.splunk.com/enterprise
Free Developer License
Splunkbase
VS Code Extension
Community Slack (#appdev)
Addon Builder
UCC Framework
Splunk Apps/Addons

18. © 2023 SPLUNK INC.
Resources
Custom Search Commands
Examples
Custom Search Command

19. © 2023 SPLUNK INC.
Resources
Packaging Apps
Packaging Toolkit
Vetting Apps
Packaging and Vetting

20. © 2023 SPLUNK INC.
Thank You!