All Apps and Add-ons

How to make search indexes configurable in Add-on panel searches?

joshuapetitt
Path Finder

I am making an add-on that will be installed in a couple of different splunk environments.

The different splunk environments use different index names for the "same" data.

I would like to make my search string somehow configurable, so the index that it searches can be configurable by the end user.

I know there are the $token$ values that can be used in panel search queries. Is it possible to populate the $token$ value from a local .conf file perhaps?

I found a related questions here:

https://answers.splunk.com/answers/221617/retrieving-values-from-config-file.html

UPDATES:

It looks like the setup.xml is what I need to include in my app:

https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/Setup.xmlconf

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @joshuapetitt, Did the setup.xml resolve your problem?

0 Karma

joshuapetitt
Path Finder

maybe? I am still researching how to properly setup setup.xml 😉 The one portion I'm still not 100% sure on is after I do have a working setup.xml, how I would reference the .conf value in the dashboard panel as a token?

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...