The Next-Gen Toolkit for Splunk Technology Add-on Development
The Universal Configuration Console (UCC) Framework was built by passionate Technology Add-on (TA) developers to make TA development faster, easier and more consistent. Whether you’re a seasoned Splunk expert managing hundreds of data sources or just starting your journey, UCC provides a streamlined way to create add-ons with rich UI, full control over output quality, and a repeatable development process.
Focus on What Matters
Technology Add-ons play a critical role in Splunk: more than half of all data ingested into the platform comes from TAs. They are the most efficient way to onboard data, parse and normalize it with the Common Information Model (CIM), and enable further analysis and detection use cases.
But TA development is becoming increasingly complex:
- The number of data sources continues to grow rapidly.
- Vendors frequently upgrade their systems and apps, changing schemas, semantics, or APIs - often triggering TA upgrades.
- Developers often manage 60+ sources, with some customers exceeding 300.
How UCC Changes the Game
UCC stands out for its flexibility, scalability, and automation. It gives developers the freedom to build smarter - without the headaches that typically come with TA development or upgrade.
As an open-source, CLI-based workflow, UCC simplifies the complex process of creating and maintaining technology add-ons. With just three simple commands (ucc-init, ucc-build, ucc-package), you can automate TA development from start to finish.
UCC puts you in complete control, allowing you to tailor every aspect of your add-ons - whether it’s modular inputs, REST handlers, authentication mechanisms, or dashboards. The result? Faster data onboarding, reduced maintenance, and essential health checks that keep your add-ons running smoothly.
With a simple, intuitive dashboard, UCC gives you the most important insights at a glance while providing granular health checks on ingested data - including volume, resource usage, and errors related to connection, configuration, permissions, or authentication. By reducing administrative work, UCC lets you focus on extracting real business value out of Splunk.
What UCC Provides
When you generate a TA with UCC, the framework produces a consistent, ready-to-use package with:
- UI Components: stored in the appserver folder.
- Python REST Handlers: stored in the bin folder, supporting UI CRUD operations.
- Inputs and Helper Modules: for reliable data ingestion and processing.
- OpenAPI Description Documents: stored in appserver/static/openapi.json.
- Configuration Files: including .conf files for app settings and metadata.
For configuration-only TAs, UCC generates the required .conf and metadata files without additional Python or JavaScript code - ensuring faster, lightweight add-ons when needed.
Getting Started
For a comprehensive, step-by-step guide, check out: Mastering Splunk Add-ons with UCC
👉For detailed instructions, visit the UCC Framework documentation
Join our UCC community!
Let’s connect! Join our Slack channel in the Splunk Community: #ucc-framework to ask questions, get support and stay in touch with us!
The UCC Framework is constantly evolving, and your input can make it even better!
Whether you prefer low-code workflows or full CLI control, we want your feedback, ideas and contributions. Jump in, collaborate, and help us expand this vibrant UCC community - together, we can take Splunk TA development to the next level!
