Splunk Enterprise

How to combine apps?

shocko
Contributor

I have several apps I have built in Splunk Enterprise 8.2.5. Each one is in a separate folder under /etc/apps on my search head and each has numerous lookups/macros etc. configured. The problem I have is I wish to combine them all into a single app as they are all used by the same people. The problem is I source control them in Git so I can easily make a change, update Gut and re-deploy the app to the search head. This amounts to it clearing out the app/<app> folder and pulling down the latest version from Git. This works great.

Now if I move everything to a single app how can I keep a folder for each 'sub app' for I can keep my Git model? Essentially I want this new app to just have a set of Navigations/Dashboards 

Tags (1)
0 Karma

Tom_Lundie
Contributor

There is no concept of  "sub-apps" in Splunk. An app is simply a collection of configurations and supplementary files. There is no way to distinguish between your sort of "sub-configurations". There is a really nice diagram to illustrate the anatomy of a Splunk App here.

If I understand your question correctly, I suggest keeping your current model and not merging your apps together. What exactly are you looking to achieve by merging the apps?

0 Karma

shocko
Contributor

I think I have explained it poorly.  I guess when I think about it what I wish to achieve is a s follows:

Problem: I have multiple search apps that have various views, navigations, macros etc. I source control the apps in Git and when I wish to create a new version of the app I do so by updating Git and deploying the folder/files from that Git repository to my search head. This works well. Each app shows in the UI as a separate entity under the Apps dropdown 

I have been re-evaluating these apps as most of them are used by the same team. They have asked me if I could combine them into one app (all dashboards, views and navigation etc.)  so they only have to navigate one app the in the Apps dropdown. I wish though to maintain my deployment model within GIT so combining them all into one single app/folder is a challenge in this regard.

So, now that I think of it is the following possible?

  1. Keep all apps separate so I keep my deployment model
  2. Remove the navigation items from these apps
  3. Create a new app that only has the navigation/views from the other apps?

 

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...