what's the difference between Splunk Web Framework and Splunk SDK?

[InkerzBrad]

Hi guys,

I'm very new to Splunk. Could anyone please explain to me what's the difference between Splunk Webframe work and Splunk SDK?

As per my understanding, Web FrameWork is libraries that only reside on server side. Their implementation cannot be seen by end users.
While Splunk SDK is a callable library that reside on client and its implementation can be seen by the end users.

Am I understanding it correctly? Please shed some light on it. Much appreciated.

[muebel]

Hi InkerzBrad, The Web Framework is a platform for building dashboards in Splunkweb ( user accesses splunk through browser, logs in like normal and interacts with app there) or your own web interface (web server other than splunkweb).

The SDKs (ruby, python, java etc) are a set of tools for developers to build applications that interact with the APIs presented by splunkd.

Please let me know if this helps!

[InkerzBrad]

Thanks muebel, but I still don't quite get it.

What I want to do is build a independent website which do some analytical stuff with the Logs.

One way I think it could be done is by using SDK on the client side communicating with a server that runs splunkd. I can do searching and display the results with a graph.

Second way is by using Web Framework. It allows me to build a new dashboard inside splunkweb, and it seems to have more powerful features than SDK (for instance, the chart graph produced by Web Framework can be zoomed in/out while the graph from SDK can't.) But the downside of using Web Framework is that the dashboard(even converted to HTML) can only be run inside SplunkWeb, while I want a separated webside.

Am I understanding it correctly? Can I use Web Framework outside SplunkWeb or can I make the graph generated from SDK have the ability to zoom in/out.

Thanks!