Splunk App Packaging

[hitesh_pawar]

Hi,

For my project I have created Dashboard and Alerts. My question is how can I package my dashboards and alerts in splunk app, so that when user installs my splunk app from zip file then dashboards and alerts will be automatically configured and installed.

Thanks And Regards
Hitesh

[Leo]

From the command line, run

 splunk package app <myapp>

[hitesh_pawar]

If I go by this approach will dashboards and alerts will also be packaged. As when I tried to install app from zip file of my app the dashboards and alerts were not imported.

Thanks
Hitesh

[bmunson_splunk]

If there are items missing, you probably have them set as private.
Go to settings All configurations chose your app from the dropdown and check on Show only objects created in this app context.
Click on the word sharing twice so it has a down arrow next to it.

Anything that has private in that column will not be packaged in your app so click on Permissions , change it to This app only and save
Repeat for all the private items. Then package using either of the above methods.

[tom_frotscher]

Hi,
you can package the folder in you etc/apps directory as zip and then share it with the other users. You can also use the splunk rest endpoint to package an app as a .spl file. If i remember correctly, you can use this in your searchbar:

| rest /services/apps/local/<appname>/package

You have to substitude by the appname of the app you want to package. You can find the .spl file in the \etc\system\static\app-packages directory if everything runs as expected. Other useres then can use the "install app from file" option from the Splunk web ui to install the app.

Always remember to check the permissions of all objects in your app. If an object is for example only private, it won't be packed in your app.

Greetings

Tom