Building Apps with Splunk 8.0
Summary
This two-day course focuses on Splunk Enterprise app development. It's designed for advanced users, administrators, and developers who want to create apps using the Splunk Web Framework. Major topics include planning app development, creating data generators adding data, custom search commands and REST endpoints, maintaining app state using KV Store, and app packaging.
Description
- Planning Apps
- Creating Apps
- Adding Data
- Enhancing Apps
- Using the REST API
- Packaging Apps
Objectives
Module 1 – Planning Apps
- Set up a development environment
- Improve app performance
- Identify Splunk log files
- Use security best practices
- Create a data generator
Module 2 – Creating Apps
- Describe the web framework architecture
- Manage apps and add-ons
- Create an app
- Configure app properties
- Create app navigation
- Add app icons and logos
Module 3 – Adding Data
- List types of data inputs
- Identify ways to add data
- Explain modular vs scripted inputs
- Understand data normalization
- Review Add-on Builder
Module 4 – Enhancing Apps
- Review commonly used knowledge object
- Learn about custom alert actions
- Build custom workflow actions
- Develop custom search commands
Module 5 – Using the REST API
- Explain how the Splunk REST API works
- Define API endpoints
- Explain how KV Store works
- Create a KV Store
- Use lookups with a KV Store
Module 6 – Packaging Apps
- Creating an app setup screen
- Define search time precedence
- Explain local and default differences
- Package an app
