Build Your Own Splunk App

You'll need NPM in order to install the app's dependencies (Marvel API Library, Splunk-SDK). This video will also cover obtaining your Marvel API keys.

This video will cover using NPM to install the app's modular input dependencies.

This video will go through the process of installing the final version of the app from Github which is available here https://github.com/HurricaneLabs/marvel

On a development Splunk environment it can be beneficial to modify how Splunk handles static file caching in order to make your Splunk development experience better.

Defining the $SPLUNK_HOME variable is important in ensuring that your modular inputs run as expected.

Covers the basic concepts of inputs in Splunk.

The creation of the cmd and sh files are important to ensure that the modular inputs run on Windows, Linux, or OSX.

The inputs.conf.spec file defines the input for the modular input.

In this video we briefly cover logging and debugging.

Before pulling the data into our modular input, we will first run a test to see how the data will look.

In this video we will build out the basic structure of the characters modular input.

The getScheme function defines the fields that will be used in the modular input.

The validateInput function handles the validation of the data we submit to the modular input.

The streamEvents function handles the indexing of events from the Modular Input into Splunk. It uses checkpoint files (text files) to determine whether or not an event has already been indexed, and if so, it skips the event. Otherwise, it moves forward with indexing the event.

The Marvel Comics Modular Input will need its own set of .cmd and .sh files in order to run in Splunk's environment.

As we did with the character's data, we also run a test to see what the comics data will look like.

Using the characters modular input as a starting point, we will build out the comics modular input.

A small bug in our checkpoint file is causing an additional line to be added. This video goes through the process of removing that bug.

This video covers the concepts of what a setup page is in Splunk.

In this video we will build out file placeholders for the custom setup page.

This video covers building out the initial structure for the custom setup page templates.

This video covers any external dependencies that we will need.

The setup.js file acts as the entry-point for the custom setup page JavaScript.

SetupView.js is provided by Luke Murphey that will make the process of building the custom setup page easier. It comes with handy functions that we can use on our own setup page. We will modify this file slightly to fit our own needs.

The model acts as the 'source of truth' for the custom setup page's current state. Using a model will help to ensure that we don't need to rely on manually updating the view of our setup page.

The SettingsView.js handles the functionality for the setup view form.

Currently, the submit button doesn't do anything, so in this video we cover adding the submit button functionality.

In this video we add the form validation.

This video covers the process of saving the API keys to the storage/passwords endpoint.

The setup page will have two states. One being a configured state, and the other being un-configured. Both states will be handled by updating the model.

The settings template needs to be modified so that the view updates depending on the state that it is in.

This video covers adding any final functionality needed on the setup page.

This video covers adding style to the setup page.

Currently our public and private API keys are hardcoded into the modular input files, which is not ideal. In this section we will build out the marvel_passwords.js file. This file will pull the public and private keys stored in Splunk. We will then use this file to obtain the API keys in the modular inputs.

This video covers pulling in the passwords into the modular inputs using the marvel_passwords.js file used above.