Splunk Dev

Configure input script through UI

klausJohan
Path Finder

hello all,

I have a input script to index data into Splunk. Through UI I want to input some configuration parameters and then write them in a file. When the script is run it should read the file and if it finds what it needs go on retriving data. Otherwise nothing happens.

In order to achieve my goal I'm thinking to use a Form for displaying the UI widgets needed. Since I'm just a Splunk beginner I must ask whether this is feasible ? and if yes what technologies need to be employed ? I am particularly interested in the following details.

  • is it possible to build simple custom UI (buttons, text-edit, dropdown widget, list)
  • is it possible to execute a particular python script when some user event happens ( press a button, something from a list is selected)
  • is it possible to dinamically load items in a dropdown list ? (I plan to read them from a file)

Otherwise could you suggest other means of configuring my app through UI. I imagine this must be somehow possible since Splunk is MVC based.

The Splunk version for which this app is intended is 5.0.5

0 Karma

ckurtz
Path Finder

I believe this can be accomplished via the Modular Inputs capability in Splunk 5. However, take a look at Splunk 6, as a lot changes with it, and Modular Inputs may be different.

Also, look at this Splunk Blog entry on Modular Inputs: http://blogs.splunk.com/2013/04/16/modular-inputs-tools/

klausJohan
Path Finder

Also the docs mention a couple of times that Spluns is MVC based. This means there got to be some other way in which one could configure and control an app.

0 Karma

klausJohan
Path Finder

I have considered this, but I want to avoid this since 1)I don't want to share my custom Modular inputs with other applications. 2) I want to provide a unified experience within the application, all should be available from my app navigation menus.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...