From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time on Splunk, Guilhem has seen the platform evolve dramatically — together with his own journey. For the past 7 years, he has been part of Splunk’s Professional Services ecosystem in EMEA as a partner, helping organizations unlock real value and operational visibility from their data.  The Birth of TrackMe  Around 2017, while working on various Splunk implementations, Guilhem identified a recurring challenge: once data was ingested into Splunk, teams often struggled to maintain visibility on data feed quality, availability, and operational health.  That’s how TrackMe was born — initially as an open-source Splunk app designed to help teams track and monitor their Splunk data feeds with ease. It quickly resonated with the community, gaining adoption across organizations worldwide.    From Open Source to a Company   Recognizing the widespread use and value of TrackMe, Guilhem took the next step in 2021 by founding TrackMe Limited in the UK, transforming his “Splunk baby” into a full-fledged product and business. Today, TrackMe empowers Splunk users globally—from the US and Europe to the UK and Australia—with a free community edition and premium enterprise editions. Despite being a small company, TrackMe serves many large organizations, with Guilhem acting as the principal developer and director, driving both the technology and the vision.    What TrackMe Does    TrackMe is tailored specifically for Splunk Enterprise and Splunk Cloud environments. It provides visibility and operational excellence by monitoring, at scale, the availability and quality of data sources — and much more. Over time, the product has expanded beyond feed tracking to include machine learning, field quality monitoring, and advanced workflow management. The app integrates with a growing ecosystem, including Splunk SOAR, Cribl LogStream, Palo Alto XSOAR, and Google SecOps.     High-Level Business Metrics Indicating TrackMe’s Success    TrackMe has consistently maintained a 5-star rating on Splunkbase. Since its inception, it has been downloaded 24,761 times. The company has a successful number of paying customers, including many Fortune 100 clients. TrackMe plays a key role for a diverse range of Splunk customers, spanning on-premise to cloud-based deployments.    Major Costs and Resource Constraints in Building TrackMe    Application Maintenance: Keeping the app updated is challenging due to evolving Splunk technologies, deprecations, and the need for regular updates. Splunk Cloud has improved with fully automated application vetting; however, app developers should remain vigilant of changes to the underlying platform—reflected through upcoming AppInspect requirements–that can impact app compatibility. For applications like TrackMe, this represents a major concern, and it is something that Guilhem is closely monitoring.  Qualification in Splunk Cloud: Developing and qualifying in Splunk Enterprise alone is insufficient; TrackMe releases undergo rigorous qualification in a true distributed Splunk Cloud environment using SCDE.  Technical Resources: TrackMe uses dedicated bare metal servers with custom automation and the Splunk Automator (Ansible-based) to run continuous production environments and create/destroy fresh deployments for testing.  Complex Deployment Factors: Support for FIPS and other complex options requires testing in valid environments. TrackMe ingests its own infrastructure logs and uses custom data generators for testing.    Favorite Developer Tools and Resources for Building Splunk Apps    Cursor AI: Intensively used for continuous development and Pull Request reviews, Cursor AI was fundamental in TrackMe’s transition to React native user interfaces.  Promox VE: Used for virtualization of development environments.  Docker: Containerizes tooling such as Eventgen, Splunk EAM, and Jenkins.  Jenkins: Manages creation, destruction, and maintenance of testing environments daily.  GitHub Actions: Automates CICD pipelines; every TrackMe release is built, qualified, and inspected automatically in fresh containers.  Appinspect API: Integrated into CICD pipelines for Pull Request validation, with custom Python handlers.  Splunk UI: Forms the foundation of TrackMe’s user interfaces.  Splunk UCC Framework: Used since early stages, serving as the backbone of the app.      Major Milestone Achieved    TrackMe has just announced the migration from the legacy JavaScript stack to native React with Splunk UI. There has been extremely positive feedback and a product that has entered a totally different dimension of quality and richness. The goal is to make TrackMe a truly modular, responsive, and future-proof solution for Splunk users worldwide.  Though TrackMe Limited remains a small company, it is built on a decade of hands-on Splunk experience, community trust, and relentless focus on operational excellence. Guilhem is excited about the future of TrackMe and the growing community of Splunk professionals who continue to inspire its evolution.  Want you or your team to be our next Developer Spotlight? Let us know by filling out this form!    Want updates like this sent straight to you? Learn how to subscribe to this blog (and follow Labels you care about) in our quick guide.  ... View more

[Register here] This thread for the Community Office Hours session on Splunk 10.0 Is Here: Your Guide to a Smooth Upgrade Journey_AMER on Thur, Dec 11, 2025 at 1pm PT / 4pm ET. Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics. What can I ask in this AMA? What is included in Splunk 10? What are the key innovations in Splunk 10 that customers should know about? What is the benefit of upgrading to Splunk 10? How can I upgrade to Splunk 10 and what is inclusive of upgrade readiness? How can I use the Splunk Health Assistant Add-on? (address EOL Upgrade Readiness App) SCP vs Splunk Enterprise Upgrade Readiness What are the breaking changes customers need to be aware of and action on? Anything else you'd like to learn!   Please submit your questions at registration. You can also head to the #office-hours Community Slack channel to ask questions (sign-in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. We look forward to connecting with you! ... View more

[Register here] This thread for the Community Office Hours session on Splunk 10.0 Is Here: Your Guide to a Smooth Upgrade Journey_APJC on Fri, Dec 05, 2025 at 9am JST (Japan Standard Time) / Thur, Dec 04, 2025 at 4pm PT / .   Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics.  What can I ask in this AMA? What is included in Splunk 10? What are the key innovations in Splunk 10 that customers should know about? What is the benefit of upgrading to Splunk 10? How can I upgrade to Splunk 10 and what is inclusive of upgrade readiness? How can I use the Splunk Health Assistant Add-on? (address EOL Upgrade Readiness App) SCP vs Splunk Enterprise Upgrade Readiness What are the breaking changes customers need to be aware of and action on? Anything else you'd like to learn!   Please submit your questions at registration. You can also head to the #office-hours Community Slack channel to ask questions (sign-in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. We look forward to connecting with you! ... View more

[Register here] This thread for the Community Office Hours session on Splunk 10.0 Is Here: Your Guide to a Smooth Upgrade Journey_EMEA on Tue, Dec 02, 2025 at 4pm CEST (Central European Summer Time) / 7am PT. Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics. What can I ask in this AMA? What is included in Splunk 10? What are the key innovations in Splunk 10 that customers should know about? What is the benefit of upgrading to Splunk 10? How can I upgrade to Splunk 10 and what is inclusive of upgrade readiness? How can I use the Splunk Health Assistant Add-on? (address EOL Upgrade Readiness App) SCP vs Splunk Enterprise Upgrade Readiness What are the breaking changes customers need to be aware of and action on? Anything else you'd like to learn! Please submit your questions at registration. You can also head to the #office-hours Community Slack channel to ask questions (sign-in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. We look forward to connecting with you! ... View more

Splunkbase Unveils New App Listing Management Public Preview We're thrilled to announce the public preview of the new Splunkbase App Listing Management experience! This release marks a significant milestone, as we complete the Splunkbase evolution by revamping the developer-facing experiences. This is a crucial step in fostering a robust developer community and empowering developers to deliver even higher quality apps for our valued Splunk customers! The Heart of Innovation: Splunkbase Splunkbase is a vibrant ecosystem, home to over 2000+ apps including contributions from Splunk, Cisco, partners, and other 3rd parties. The Splunkbase App Listing Management pages are where developers bring their creations to life, providing details like descriptions, screenshots, troubleshooting guides, installation instructions, and compatibility information. By doing so, developers not only showcase the quality of their apps but also attract more customers to download and install them. Exciting New Capabilities for App Developers These new developer-facing pages introduce several powerful new features designed to streamline workflows, enhance quality, and build developer reputation: 📌 Draft App Listings: Developers can now create app listings and save them as drafts, returning to complete them before publication.  📌  Large Package Support: A game-changer for innovation! Splunkbase now supports app packages up to a massive 2GB, a significant leap from the previous 100MB limit.  📌 Developer Profiles: We're empowering developers to build their reputation within the Splunkbase community.  📌 Visualized AppInspect Reports: When uploading to Splunkbase, AppInspect reports are now visually presented with helpful descriptions for any failing checks. 📌 Fully Automated AppInspect: Say goodbye to long waiting times! The AppInspect process reduces the review time from an average of 5 days to just 5 minutes.  Looking Ahead This revamp of the Splunkbase App Listing Management experience is a testament to our commitment to the developer community. By providing these advanced tools and capabilities, we're not just improving a platform; we're fostering innovation, enhancing app quality, and ultimately, delivering a better experience for all Splunk users. We can't wait to see the incredible apps you'll build with these new features! ... View more

Qmulos: Building a Next-Level Cybersecurity Business through Splunk Apps  Qmulos started as a scrappy startup with a bold vision: to revolutionize cybersecurity compliance and user behavior analytics. Today, the company has grown into a powerhouse, blending the talents of engineers with diverse backgrounds ranging from finance and gaming to large-scale cybersecurity. At the core of their success is a passionate team pushing the boundaries of Splunk app development, delivering cutting-edge solutions like their flagship Q-Compliance app. These advancements supercharge Qmulos’ business and usage metrics when paired with Splunk. Some of these impressive figures include:  Over 2500 systems, applications, and programs (i.e., accreditation boundaries) managed for compliance;  More than 120 TB of technical compliance evidence automatically collected via Splunk;  Over 700K security controls monitored and assessed; and  Support for more than 20 security and compliance frameworks.  These metrics highlight the extensive scale and automation capabilities Qmulos provides in managing compliance and security posture through Splunk integration. Join us as we spotlight the dynamic people, innovative technologies, and unique culture that fuel Qmulos’ ongoing mission to secure both public and private sector IT environments. Qmulos Scales Up by building a High-Impact Cybersecurity Team The Qmulos team ranges in experience from earlier career engineers to veterans in the industry, ranging from a couple years of experience to decades. As a company, it started as a small scrappy start-up and has grown into an organization with multiple teams focused on delivering mission-critical cybersecurity compliance and user behavior analytics solutions for public and private sector customers. From Finance to Gaming: Qmulos Innovates Qmulos team has a diverse, if not somewhat unconventional history. While most team members had adjacent cybersecurity experience by virtue of developing software in large engineering teams, they have team members who came from backgrounds in financial institution solutions, supply-chain management, and even game and hardware development. Qmulos: Engineering the Future of Splunk Apps Qmulos has been pushing the boundaries of Splunk app development for over a decade. Their products target Splunk Enterprise and Splunk Cloud Platform, creating feature-rich experiences that exercise Splunk’s data collection, search, investigation, alerting, and visualization capabilities. Trying to stay on the cutting edge of Splunk’s offerings, Qmulos leverages tools such as the Splunk Machine Learning Toolkit (MLTK) app for advanced analytics and Splunk UI Toolkit for a modern UX experience. Q-Compliance App: How Qmulos Revolutionized Cybersecurity with Splunk Q-Compliance is Qmulos’s largest Splunk premium application, offering near real-time visibility into device compliance and security posture. It’s used by ISSOs, CISOs, Sec Ops, assessors and anyone else monitoring and reporting on IT infrastructure. It utilizes Splunk to collect data across many different categories such as network, firewall, account management, configuration management, and others that are required to be reported against as part of operating within the government and commercial space. Built by a team experienced in large-scale cybersecurity solutions, Q-Compliance leverages Splunk to deliver continuous monitoring without the bottlenecks of traditional SQL databases. This enables efficient audit preparation and enterprise-wide reporting, enhancing security operations and team productivity. Enhancing Development with Generative AI and Splunk Tools The team has recently realized significant productivity gains by using generative AI to research approaches and prototype new features. Maintaining tight feedback loops is critical for productive development, so they routinely use various “soft reset” commands available in Splunk – such as “_bump” and the /debug/refresh pages – which allow engineers to quickly see the results of code changes without requiring a full restart. Similarly, the Splunk Add-on for Visual Studio Code simplifies the development and debugging of custom Python endpoints, further streamlining the workflow. From Martial Arts to Masterpieces: Qmulos’s Team Got All the Moves (and the Games!) Qmulos is fortunate to have an uncharacteristically talented team. From award winning competitive martial artists, musicians that perform in and lead professional ensembles, to people who have appeared on television as actors. For fun, this amazing team is interested in sports and gaming (card games, board games, and video games).   Want you or your team to be our next Developer Spotlight? Let us know by filling out this form! ... View more

Watch On Demand. This thread is for the Community Office Hours session on Splunk 10.0: Your Guide to a Smooth Upgrade Journey on Thurs, Oct 02, 2025 at 1pm PT / 4pm ET.   Join us for a first look at the next evolution of Splunk Enterprise and Splunk Cloud Platform, Splunk 10, featuring powerful new capabilities to enhance data security, simplify operations, and ensure compliance readiness. This interactive Office Hour will not only highlight key updates designed to future-proof your Splunk environment but also provide a space to address your upgrade readiness questions in real time, with Splunk experts on hand to assist.   What can I ask in this AMA about the next Splunk upgrade? What is included in Splunk 10? What are the key innovations in Splunk 10 that customers should know about? What is the benefit of upgrading to Splunk 10? How can I upgrade to Splunk 10 and what is inclusive of upgrade readiness? How can I use the Splunk Health Assistant Add-on? (address EOL Upgrade Readiness App) SCP vs Splunk Enterprise Upgrade Readiness What are the breaking changes customers need to be aware of and action on?   Please submit your questions at registration. You can also head to the #office-hours Community Slack channel to ask questions (request access here).   Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. We look forward to connecting with you! ... View more

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with hands-on experience in Cloud, Security, and IT Operations. Starting his career in web development, he moved into Platform Engineering and Public Cloud infrastructure, earning the nickname “The Splunk Guy.” His SRE roles deepened his understanding of enterprise systems, which he now leverages in app development. Since creating Splunk apps locally in 2013, William released his first public app, AWS SQS Monitoring, in 2017, refining his expertise in Splunk app design. He has since published numerous apps on Splunkbase, many inspired by personal projects and real-world challenges.  Behind the Build: A Dev’s Story from Curiosity to Splunk .conf After his 2017 Splunkbase release, William discovered that building an app for public use required a new level of design, documentation, and portability. Many of his projects started as personal experiments, but sharing them with the Community has been highly rewarding. He has also delivered a number of .conf talks and workshops on app development, focusing on getting started, tools and techniques, and his passion for  CI/CD. Splunking Since 2013: From Pandemic Response to Cloud Powerhouse In 2020, William was tasked with building a monitoring service for the UK’s Covid vaccination and Test Tracking initiatives using IT Service Intelligence (ITSI). What began as a single-use case quickly evolved into a major project, with teams across the country utilizing the monitoring and sending logs in every format imaginable. This deepened his understanding of Splunk’s capabilities. Since then, he has consulted for UK companies, focusing on Splunk Cloud, On-Prem to Cloud migrations (including ITSI and Enterprise Security), and elements of the Splunk Observability Suite.  Deploy Smarter, Not Harder: Inside the Automated Deployment Helper for Splunk Cloud The app addresses CICD challenges by automating Splunk deployments using on-demand or scheduled authentication tokens. It supports Github.com, GitLab.com, GitLab Hosted pipelines, and AWS Secrets Manager. By generating short-lived, task-specific tokens, it enhances security, minimizes unauthorized risks, ensures token accountability, and enforces least privilege. This solution supports DevOps and CI/CD practices, reserving admin credentials for emergencies while delegating tasks to non-admin staff via role-specific tokens.       Behind the App: Simplifying Splunk Cloud Workflows with Secure Integration Splunk's REST APIs and cloud platform facilitate CI/CD integration, but managing secrets and tokens can be challenging for enterprises with strict security needs. To address this, the app was developed to generate short-lived, scoped tokens just-in-time, streamlining workflows, enhancing security, and enabling audit trails. Initially designed to export Splunk Cloud app contents into Git for audit and version control, the app evolved to support a two-way sync between Git and Splunk Cloud, supporting use cases like managing Splunk Cloud via the Admin Config Service, performing backups, and deploying Splunk ES consistently using tools like GitLab CI and GitHub Actions. Splunk App Development Like a Pro: Tools That Make It Easy For Splunk app development, the Universal Configuration Console (UCC) Framework is recommended for simplifying modular input apps that pull data from API endpoints. Complementing UCC, the Pytest Splunk Addon provides automated test coverage, offering reassurance for both Splunkbase apps and internal apps, ensuring compatibility with Splunk version upgrades or app changes. Additionally, the Splunk UI testing framework automates UI configuration workflows just as a real user would, enabling the application of DevOps best practices, such as Test-Driven Development, to Splunk app projects. The Splunk community is beginning to embrace these practices, and broader adoption is encouraged. For those new to Splunk app development, sessions like "Splunk App Building 101: Learn, Create and Navigate the Ecosystem" provide excellent starting points with workshops and downloadable guides. Experimentation and community support are key to success. Tech Projects and Tiny Hands: A Day in Will’s Life Would you believe it - William often finds himself working on more Splunk projects in his spare time! It’s a bit of a busman’s holiday. Joking aside, he has a young family (three girls!) who keep him busy and make it hard to tackle the backlog of personal projects. Lately, he’s found himself spending more time on creative endeavors around the house: perfecting sourdough (but it never lasts until the next day), gardening, and crafting (and being drawn on!) with the little ones. Want to be our next Developer Spotlight? Let us know by filling out this form! ... View more

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve listened closely to customer feedback, customers can now filter and browse apps based on author type—Splunk, Cisco, Partners, and Community. This simple yet powerful update introduces clearer trust signals and helps accelerate the path from search to solution. This update is more than just a new filter—it's the first step toward a more nuanced and effective approach to app discovery. By laying the groundwork for differentiated quality tiers and deeper engagement, we're creating a path toward a future where customers can confidently navigate offerings that best fit their unique needs. Apps marked as Built by Splunk or Built by Cisco are built and supported by Splunk and Cisco, respectively.  Apps marked as Built by Partners are built by official Splunk Partnerverse Build motion partners. If you’d like to learn more about being a Splunk Partner reach out to partnerverse@splunk.com. Community apps are the bulk of Splunkbase apps. It’s where Splunkbase began - admins building apps for other admins. This is a vital part of our marketplace that is now highlighted in a place of its own!  Our goal is simple: make it easier for customers to find exactly what they’re looking for, without limiting the variety of options available. This release balances structure and flexibility—offering powerful tools to narrow down choices while still embracing the diversity that makes our ecosystem thrive. In today’s digital landscape, application marketplaces have become essential for staying competitive. They streamline operations, improve efficiency, enable innovation, and deliver significant business value. For vendors, they enhance customer retention and open new channels for differentiation. The Critical Role of Application Marketplaces, a report by Futurum Research in collaboration with Splunk, explores how organizations are using platforms like Splunkbase, which features matter most to users, and how these ecosystems are adapting to today’s evolving IT and security landscape. As outlined in the Futurum Research report: “Looking across the application marketplaces companies utilize, several factors that influence their use of a marketplace stand out.” Application marketplaces have become mission-critical in the race to stay digitally competitive. What’s emerging on Splunkbase is only the beginning—stay tuned for what’s next. ... View more

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building new solutions, refining your existing apps, or just getting started, we’ve got a wealth of updates, insights, and opportunities for you to grow your skills and get more from the Splunk Platform. Splunk Developer Program + Splunk Build-a-thon  The Splunk Developer Program is launching in beta—a new *free* program designed to provide our developer community with the tools and resources needed to build high-quality apps all from a centralized hub. Check it out / sign up at preview.dev.splunk.com We’re celebrating this launch with an exciting hackathon! This is your chance to showcase your skills, explore Splunk’s developer capabilities, and compete for amazing prizes including .conf passes, Splunk EDU credits, and Cisco Store gift cards. Register Now! App Dev Community Office Hours Our most recent Community Office Hours session focused on OpenSSL3 and other upcoming changes to the Splunk Platform. Experts Tedd Hellmann and Michelle Moreira provided guidance on how to get your environment ready, while answering live audience questions and sharing actionable tips. If you missed it, no worries—you can watch it On Demand. Tech Talk: Holistic Visibility and Effective Alerting Across IT and OT Assets   On April 21st, we hosted a Tech Talk with security experts from Tenable to explore how combining Tenable and Splunk helps organizations achieve holistic visibility and effective alerting across both IT and OT infrastructures. It’s a must-watch for anyone focused on proactive cybersecurity. Watch it On Demand. SPL2 Hands-On Workshop Series Our SPL2 workshop series is here to help you unlock the full potential of the Splunk platform. These sessions walk you through getting started with Edge Processor, Ingest Processor, and utilizing SPL2 for app development. Perfect for developers ready to level up their Splunk skills. Catch the workshops On Demand. Developer Spotlight Series We’re excited to continue our Developer Spotlight blog series, where we feature standout developers from across our Splunk Community: Cameron Schmidt: A veteran Splunk app developer with over a decade of experience, Cameron has contributed dozens of apps to Splunkbase. Read more. Brett Adams: A SplunkTrust member and consultant, Brett’s innovative development work and community leadership have made him a key voice in the ecosystem. Read more. Preparing for OpenSSL3 and Platform Changes The next Splunk Platform release brings important security and compliance enhancements, including the transition to OpenSSL3. It’s vital to prepare your environment and apps now. We’ve compiled helpful resources to guide you: Preparing your Splunk Environment for OpensSSL3 Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the Next Splunk Platform Release Preparing to upgrade from 9.x to the upcoming release of Splunk Enterprise and Splunk Cloud Platform Splunkbase Year in Review 2024 2024 was a year of innovation and progress for Splunkbase and the App Dev Community. From enhanced tools and developer resources to new app ecosystem features, we’ve laid a strong foundation for an even bigger 2025. Check out the Year in Review. Join the Conversation and be part of the Splunk App Dev Community Connect with the Community on the #appdev Slack channel by clicking on this link, and if you are not part of our Slack community yet, get added here! ... View more

Reflecting on 2024, it’s clear that innovation and collaboration have defined the journey for Splunk developers, partners, and customers. From transformative app integrations to powerful AI enhancements and a thriving developer community, this year has been packed with momentum—and we’re just getting started. With the infographic linked below, let’s walk through the impactful ways the Splunk community came together to solve challenges, share knowledge, and push the boundaries of what’s possible! Hear from our customers and partners In 2024, we saw a number of partners and customers leverage Splunkbase apps to drive digital transformation. Here are a few standout examples: The following case studies showcase how Splunk Partners create winning joint solutions:   Splunk & Recorded Future Integration Gaining Digital Resilience with Recorded Future and Splunk. This collaboration tackles data overload, compliance challenges, and SOC bandwidth issues by integrating advanced threat intelligence and automation. Read more Mastering Threat Hunting. This insightful Tech Talk with Recorded FDuture dives into the world of threat hunting and explores the key differences between indicator-based and behavior-based approaches. Read more Infoblox App for Splunk Enhance Security & Network Visibility with Infoblox. Infoblox, a Splunk partner since 2011, developed an app to empower SOC analysts with advanced threat detection and response, boosting security efficiency. Read more   Splunk AI Assistant for SPL app With the launch of Splunk AI Assistant for SPL App, we offer bi-directional translation between natural language (NL) and Splunk Search Processing Language (SPL) to help Splunk users save time.   Developer Spotlight Closing out the year, we launched a Developer Spotlight blog series, where we feature some awesome Splunk developers from across our Community while showcasing their work. Check out the first spotlight on Paul Stout and his work behind the Duck Yeah! App. Also, if you are interested in being our next Spotlight, let us know by filling this form.    Apply to DAC 2.0  Builder Bar Returns – Revitalized with a renewed focus on the Developer Track at .conf24, we were honored to host and engage with 700+ Splunk practitioners. App Ecosystem Growth – Over the past year, Splunk has expanded its developer outreach and education, strengthening its community. A variety of resources – blogs, videos, tech talks, and courses – have helped developers grow the ecosystem. Blogs and videos shared best practices, while expert-led Tech Talks and courses provided deep insights and hands-on learning. These initiatives have empowered developers with the latest tools and knowledge to drive innovation. What’s Coming in 2025 Updated Splunkbase App Listing Experience featuring ability to create app listing drafts, view AppInspect results immediately, and conduct more administrative tasks like changing the app owner.  Developer Program Launch + Hackathon: This program empowers developers with tools, resources, and support to build innovative apps, enhance data insights, and grow within the Splunk ecosystem. Register for the Hackathon here .conf25: Thank you to everyone who participated in the call for papers process. We are actively working through content and event planning for an even better experience for our builders. Splunk .conf25 is heading to Boston this year, register now!  As we wrap up 2024, we want to thank our incredible Splunkbase community for their passion, innovation, and dedication. Your contributions continue to make Splunk a powerful platform for data-driven insights, security, and operational excellence. 2025 promises to be an even more exciting year with enhanced developer experiences, new features, and a stronger focus on AI and security. Stay engaged, keep building, and let’s shape the future of Splunkbase together! ... View more

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative developer, and esteemed member of the SplunkTrust. With over six years of experience, Brett has become a key figure in the Splunk community. His journey into app development began in 2019, driven by his passion for solving real-world problems, often fueled by unique use cases and his own creative spark. When he's not transforming data, Brett brings his love for video games, cars, and public transport into his work, while also dedicating time to hobbyist coding, open-source contributions, and home automation projects. Join us as we dive into Brett's inspiring journey! How Building Custom Apps Transformed My Career I've been a Splunk Consultant for 6 years, currently with Deloitte Australia, and a member of the SplunkTrust for three and a half years. I began developing Splunk apps in 2019 to solve a specific customer problem that couldn't achieve the right outcome using Add-on Builder, so I taught myself how to use the SDK and write apps directly in Python. My first app was a GDI app to get audit logs from Atlassian Cloud. That experience sparked my journey into app development, leading me to build dozens of apps, most of them available in Splunkbase, to ingest and manage various data sources in Splunk. From Personal App Dev Projects to Innovation and Success at Splunk Almost half of my apps are not solving a real world problem, but instead were something that I wanted. The second app I ever wrote ingested Metrics from the Forza video games, and the third app ingested Metrics from my car. Over the years, my best apps have been the ones I personally wanted and cared about. This has allowed me to continue learning and improving my skills without losing interest, which provides better outcomes for customers, and also contributes interesting use cases to the breadth of what Splunk can do. A memorable moment was when a group of Splunk interns were demoing a public transport use case they had built using my GTFS app, without realizing I was the developer. A Journey from Data Center Monitoring to Cybersecurity Expertise I've been a Splunk user since 2016, and primary work in Splunk Enterprise, however the last few years I have had to focus more on Splunk Cloud. I got into Splunk through a quirky start—using it to monitor air conditioners after seeing a demo from a salesperson. So my entrance into Splunk was monitoring data center air conditioners, weirdly enough. My focus later shifted to cybersecurity, especially in the financial sector, where I deepened my expertise. Now, I work broadly across Splunk, often in cybersecurity, and have published several single-purpose apps on Splunkbase. The Have I Been Pwned Domain Search app.  This app is a service that can notify individuals and organizations when their credentials have been found in a data breach. Domain search is a newer feature that allows organizations to search for all breaches that include any email in their domains, and access that via API. The Have I Been Pwned Domain Search app takes your API key and downloads all the breach information for the domains you have verified with Have I Been Pwned. It uses a custom Splunk UI setup page to make it easy to get started, and has a bunch of built in dashboards so you can quickly visualize and investigate the data. Building a Game-Changing Splunk App with Troy Hunt's API As soon as Troy Hunt, creator of Have I Been Pwned, announced the Domain Search API, I knew it would be a highly valuable data source for Splunk, because it's exactly what I wanted in Splunk 6 years earlier when I was working as a Cyber Security Analyst. So despite not having any customers asking for it, or even having a use for it myself, I got to work building the best app I possibly could, and even collaborated with Troy directly to suggest improvements that made the App work even better. It can be used by any industry, any company, any type of business that will need this or that will take advantage of the support given by the app. As a result the app was highlighted on Troy's blog and I met up with him in person for a coffee chat after the release. Top Developer Tools and Resources for Building Apps I used to build all my apps in Config Explorer by Chris Younger, which I still highly recommend for anyone using Enterprise, but these days I am using Dev Containers in VSCode, so that I can build fully custom user interfaces with Splunk UI. The Splunk UI framework has been fantastic to work with and their tutorials were enough to get me started without even knowing React. My other two main resources are just using dev.splunk.com and reading the Splunk spec files directly.  Tips and Best Practices for Beginners Building Apps for Splunk I think that Add-on Builder is a great starting point, but to become a skilled app developer, you really need to go beyond what it's capable of and understand how the systems work. The more you learn to combine its capabilities yourself, the better your Splunk capabilities will be.  So, the only other advice I tend to give people is just use Splunk, build everything in Splunk, do anything in Splunk because it's just a great way to learn and find the edge cases. Each challenge, driven by personal motivation, has become a valuable step forward in my development journey. Think of Splunk as a Swiss army knife: it can do almost anything, and pushing its limits is a great way to learn and a whole lot of fun.  Off the Clock, Still in the Code One of the reasons I have so many Splunk apps is because I do enjoy coding. I think software development and coding is sort of one of my hobbies. I also maintain numerous Home Assistant integrations, open source libraries, and am working on a vehicle telematics app for the Splunk EdgeHub. Not because anyone's asked me to because I want to see if that's possible. So again, it's just things I enjoy and I'm interested in messing around with. Outside, I enjoy cycling and walking with my family. Conclusion Brett’s journey through the Splunk ecosystem is a testament to what’s possible when passion meets purpose. From solving real-world problems to building tools just for fun, his story highlights how curiosity and creativity can evolve into impactful innovation.  Whether he’s building tools to monitor game data, contributing to cybersecurity, or just exploring what’s possible with Splunk, Brett brings both passion and purpose to everything he does. His journey reminds us that some of the best solutions—and most fulfilling projects—come from ideas we’re personally excited about. And in Brett’s case, that excitement continues to drive both his professional success and his contributions to the wider Splunk community. Want to be our next Developer Spotlight? Let us know by filling out this form! ... View more

Introduction In this Developer Spotlight, we feature Cameron Schmidt, a Splunk app developer at Hurricane Labs. With over a decade of experience, he has helped enhance Splunk’s functionality with over dozens of Splunk apps — many of which are featured on Splunkbase. Join us as we explore his journey and impact. From Curiosity to Code: A Developer's Journey Cameron’s journey into software development began 13 years ago, fueled by his passion for problem-solving and data-driven solutions. For the past nine years, he has been a key contributor at Hurricane Labs, where he has developed numerous Splunk apps, including the Better Webhooks app and the Hurricane Labs Content+ app. "I enjoy solving complex problems, optimizing workflows, and building applications that make data more accessible and actionable," Cameron shares. His work focuses on creating new integrations and enhancing existing tools to improve the user experience for Splunk developers and administrators. Getting Started with Splunk: The First Steps Cameron was first introduced to Splunk as a college intern working in his university’s Security Department. "At the time, our team had just started using Splunk for threat detection, but there was a steep learning curve. No one had deep expertise yet, which gave me the opportunity to dive in and learn it from the ground up." As he became more familiar with Splunk, Cameron saw the need for additional tools to expand its capabilities. "We quickly realized that while Splunk was powerful, some of our needs went beyond its default features. That’s when I started developing custom Splunk apps to fill the gaps." This hands-on experience set the foundation for his career. After college, he joined Hurricane Labs as a Splunk app developer, where he has spent years building custom solutions for organizations looking to maximize their Splunk investments. Creating Custom Splunk Solutions Throughout his career, Cameron has developed apps for a wide range of organizations, from small startups to large enterprises. "Every business has unique needs. While Splunk is an incredible platform, sometimes the built-in tools don’t quite get users where they need to be. That’s where custom development comes in." With extensive experience developing Splunk applications, Cameron has built dozens of apps tailored to security monitoring, performance optimization, and specialized integrations. "I love the challenge of extending Splunk’s capabilities to meet new demands. There’s always a way to push the limits of what’s possible with the right tools and a bit of creativity." The Better Webhooks App One of Cameron’s notable contributions is the Better Webhooks app, which enhances Splunk’s webhook functionality. "Splunk has a built-in webhook feature that triggers HTTP requests when alerts occur, but it’s fairly limited and lacks flexibility," he explains. Seeing an opportunity to improve the integration experience, Cameron built the Better Webhooks app. "Think of it as upgrading a basic wrench to an adjustable one. This app expands integration possibilities, adds advanced features, and improves security—something that’s crucial for many businesses." At Hurricane Labs, for example, the team relies on Webex for communication, but Splunk’s default webhook security was insufficient. "This app not only increases functionality but also ensures safer integrations, which was a major improvement for us." Go-To Developer Resources When it comes to building Splunk apps, Cameron has a few go-to resources. "I visit the Splunk Developer Portal frequently—it’s full of valuable documentation that I highly recommend. Splunk Lantern is also a great place to find well-written, in-depth articles." He’s also an active participant in the Splunk Community Slack group. "It’s a volunteer-driven space, but I’ve found it incredibly helpful when tackling tricky development challenges. The community is always willing to share knowledge." Pro Tips from Cameron For those new to Splunk app development, Cameron emphasizes the platform’s flexibility. "With many tools, you’re often constrained by what an app or integration allows you to do. That hasn’t been my experience with Splunk—its openness is one of the reasons I love building apps for it." He encourages new developers to experiment and push boundaries. "I hope other app developers discover the same sense of freedom and creativity that I’ve found in Splunk development. There’s always room to innovate." A Spicy Hobby: Growing Peppers Outside of development, Cameron has a unique hobby—growing peppers. "It started as a COVID project, but I’ve really come to love it. I built a small raised garden in my backyard, where I grow all sorts of hot pepper varieties. Every fall, I turn them into hot sauce and give them away." "Some of them can be extremely hot, so I always make sure people are prepared! But not all of them are super spicy—there’s a good mix." Conclusion Cameron Schmidt's passion for development and problem-solving drives his impact in the Splunk community. His commitment to creating innovative tools and empowering organizations with data serves as an inspiration for aspiring developers. Stay tuned for more inspiring stories in our Developer Spotlight series!  Want to be our next Developer Spotlight? Let us know by filling out this form! ... View more

Register here. This thread for the Community Office Hours session on Future Proofing your Splunk Apps: OpenSSL3 and More on Thur, Apr 17, 2025 at 1pm PT.   Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics. What can I ask in this AMA? Why is Splunk transitioning to Open SSL version 3 and when? Which customers will be impacted by the OpenSSL3 upgrade? How can I prepare my Splunk environment and applications for Open SSL3? What tools are dependent on OpenSSL3? What benefits will I get with the FIPS-140-3 certified OpenSSL3 library? What will happen if my app or client using SSL 3.0, TLS 1.0, TLS 1.1 tries to establish a connection with Splunk running OpenSSL3? What will happen to my apps if we ship OpenSSL3, but some apps use TLS 1.0 or 1.1?   Please submit your questions at registration or as comments below. You can also head to the #office-hours user Slack channel to ask questions (request access here).    Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants.    Look forward to connecting! ... View more

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part technical workshop series designed to help you harness the power of SPL2 and data management at Splunk.  Kickstart your journey by learning how to get started with Edge Processor and Ingest Processor. Then, join us for a deeper-dive into Splunk’s Search Processing Language, version 2 (SPL2). Finally, leverage the power of SPL2 to build apps that extend the capabilities of the Splunk platform.  Whether you’re looking to streamline data pipelines, dive deep into SPL2, or build powerful apps, these hands-on sessions will give you the knowledge and tools you need. Each session will include plenty of time for live Q&A so you can get real-time help from Splunk experts.  Register below and share with your team! Data Management at Splunk: Applying Your First Pipeline  Tuesday, February 18 | 11AM–12PM PT Learn how to get started with the Splunk pipeline builders. Follow along to configure your edge nodes in Edge Processor and build a basic SPL2 pipeline to filter, mask, transform and route data to Amazon S3.  Register now > Data Management at Splunk: SPL2 Deep Dive Tuesday, March 4 | 11AM–12PM PT Get a technical deep-dive on SPL2 in data management. Learn key SPL2 commands and common use cases. Walk away with a library of SPL2 templates to start processing data in Edge Processor or Ingest Processor. Register now > SPL2 for App Development at Splunk Tuesday, March 18 | 11AM–12PM PT Now that you have a solid understanding of SPL2, you can learn about SPL2's powerful new developer-friendly capabilities and tooling to make your app customization more powerful than ever before! Register now > Ready to unlock new Data Management capabilities and gain control over your growing data volumes? Let’s get to it! Feel free to join the #DM-pipeline-builders and #appdev Slack channels to ask questions, get help, and connect with the Splunk Community (join Slack here). ... View more

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk developers from across our Community and showcase their work. Today, we're excited to introduce Paul Stout and his amazing work behind "Duck Yeah!". Writing code since he was 8  Paul is currently a principal consultant for a Splunk Partner, SOI solutions. He's an experienced developer who has been writing code since he was about 8 on the Atari 800 and Apple IIe computers. Paul has a deep understanding of the Splunk Platform, having worked for Splunk, with Splunk customers, and with Splunk Partners. While he frequently uses Splunk Enterprise and Splunk Cloud, he also has experience with ITSI deployments and Splunk Enterprise Security. Journey as an app developer In 2011, Paul was brought to work for Splunk to implement Splunk at Splunk – a project formerly called Splunk(x). At the time, he had never built a Splunk app or even used Python. Despite this, he was able to figure it out and successfully build an app for SalesForce. You can still find his original TA-SFDC in the Splunkbase archives bearing SalesForce's 2011 logo. From there, Paul continued building things and one of his most downloaded apps is the WebGL globe, a project he initially developed in the basement of 250 Brannan and later revived as a Splunk customer. About the Duck Yeah! app One of Paul's most iconic app developments is "Duck Yeah!", a developer tool that properly packages and vets Splunk apps for distribution through AppInspect. Since building it, Paul hasn't released a single app without passing it through "Duck Yeah!" first. He does most of his Python/JavaScript/CSS in vim, using a mix of vim and the Splunk UI for SimpleXML and other knowledge objects required for apps to function properly. "Duck Yeah!" is designed to cater to developers of varying comfort levels with command line and UI, making it easy to package an app or identify any issues, regardless of how it's built. Think of "Duck Yeah!" as a wizard that guides developers through the critical metadata for an app, then handles the heavy lifting using a combination of native Splunk tools and some custom magic. Advice for other Splunk developers: “Think of something and then build it” We asked Paul for advice he would give to someone just starting to build apps for Splunk, and his answer was: "Think of something – 'wouldn't it be cool if Splunk could do x' – and then build it. Use the tutorials, starter/samples, and Splunk Answers. Download other apps and reference how they're built (don't steal!). If an app has an open-source license, start small. Get a copy of something and make small modifications. Gradually work up to bigger changes. If you're going to do visualizations, learn how to work with Node.js and npm. But above all, have a solid understanding of what a search is in Splunk, how it stores and manipulates data, and how to use the platform in general." Paul outside of work When Paul isn't in the development world, you can find him attending big events DJing as a dubstep DJ in Denver. He's also an aspiring producer and enjoys cooking in his free time. Thank you, Paul! It's been awesome getting to know you and hearing about your journey as an app developer. Stay tuned, readers! There's more to come in this Developer Spotlight series! If you are interested in being our next Spotlight? Let us know by filling out this form. ... View more