Splunk app sideload/reverse engineer

[danrogers1982]

Hey all, I came across Website Monitor splunk app and its exactly what we need to monitor all of our tools. Problem is, we cant install apps! Especially ones that aren't legit splunk made. Can anyone walk me through implementing the xml so I can get the dashboard built?

https://splunkbase.splunk.com/app/1493/
Or let me know if its even possible. Thanks, much appreciated!

[LukeMurphey]

That app is open-source so you can view the source-code and pull out the portions that you want: https://github.com/LukeMurphey/splunk-website-monitoring

That said, this isn't trivial unless you intimately know how to make Splunk apps. The app includes Python code to run the modular input which gets the data. You would need to implement that in addition to the dashboards. The dashboards are pretty easy to copy over, the Python code is much more difficult.

I'm not sure of the reasons why your company won't allow the installation of apps but let me offer some thoughts:

1. If your management is concerned about non-Splunk apps on your main Splunk installation: Perhaps you could get approval to install Website Monitoring on a Heavy Forwarder that sends the events to your Splunk install. This would keep the app off of you main Splunk install. You would then create the inputs on the Heavy Forwarder but could view the data on your main Splunk install.
2. If your management is concerned about non-Splunk apps being of lower quality: I actually am a Splunk Developer (though I made this app in my free time). I also have created about 30 Splunk apps (including being the founder of Enterprise Security app). This app also have substantial number of tests which run in my CI system. Thus, quality ought to be pretty good.
3. If your management is concerned about non-Splunk apps not having support: Its true that this app won't come with official support. However, neither will something you write yourself.

[danrogers1982]

Luke,

Thanks so much for your reply! I see that you are very active in this community and I appreciate it greatly. Being very new to this splunk game, I am very behind but very interested and eager to learn. I have sent your reply up to see how they want to proceed. The parts that I would need from your gihub link would be the xml files, correct?

[LukeMurphey]

The XML files would only get you the views but wouldn't get the data. For the data your would a lot more files.

[danrogers1982]

Ok sounds good. Hopefully they sign off on us getting the whole app! Super slick and exactly what we need.