How to create and design a custom Splunk application similar to the Splunk App for Web Analytics?

[pladamsplunk]

In the application store, you see many apps, but there it little to no information on how someone can create their own similar apps for their own personal needs.

My goal is to create an application similar in functionality to the "SplunkAppForWebAnalytics", but I have no idea how to get started.

What I do know is that I want my searches to automatically display the fields

'host'
'http_method'
'http_referer'
'http_request'
'http_user_agent'
'source'
'sourcetype'

just as in the Splunk App for Web Analytics, and I also want to be able to create custom dashboard tabs similar to 'analytics center', 'audience', 'traffic'... etc

[craigv_splunk]

Apps are a collection of dashboards, saved searches, and configurations for Splunk.

You can certainly fork an app and customize it to your own needs (assuming that the app EULA allows such activity)
All of your apps are located in the $SPLUNK_HOME/etc/apps/
The subfolders in those directories contain the configurations and dashboards that make up an app.
The xml for dashboards can be found in $APP_HOME/default/data/ui/views
The configuration files contained in the app are found in $APP_HOME/default/

If you make changes to configurations it is best to write those changes not to the default folder but to the local folder which should have the same structure within it

If you don't want to mess with the conf files directly, your best bet is to create a copy of the app.
Ex. * cp $SPLUNK_HOME/etc/apps/YOURAPP $SPLUNK_HOME/etc/apps/YOURAPP_copy*
Then go to the copy in the ui and make your changes to it there. If you like your changes and it is stable, then you can use that app instead of the original.

For more see: http://dev.splunk.com/view/get-started/SP-CAAAESC

[pladamsplunk]

Also is there any was to basically copy the app rename it and just change the functionality slightly to my personal needs?

[maciep]

There is some documentation on Splunk's site that might be useful:
http://docs.splunk.com/Documentation/Splunk/6.4.1/AdvancedDev/AppIntro

An app is essentially just a container for other objects - reports, dashboards, lookups, field extractions, etc. And if you have the permissions, it should be a simple as creating a new app from the Splunk web interface (to get started at least).

But it helps to have a good understanding of how Splunk works as well. You may be able to copy an app, but that could tricky/frustrating if you don't know how the app works, and can't figure it out. You might also be able to create a custom dashboard in the app itself as well. That way you can take advantage of its field extractions, macros, etc.

[ChrisG]

See also this introduction to app development on the Splunk Developer Portal.