Splunk Setup Page

Note

Sometimes you need to store or pass some information to your splunk app, it could be custom JAVA_HOME path, or PYTHONPATH environment variable or IP Address of remote server or anything.

Here we will build a small Splunk setup app that will help to solve these most of the common problems related to one time setup.

---

Problem

I want to create a setup page with following information.

---

Solution

Here we are developing a sample Splunk App that will demonstrate the functionality of setup page.

Requirement

1. Splunk software - You can download this free from Splunk website
2. Source code editor
3. Web Browser with internet access
4. 7 zip

App directory structure

• Create an empty directory e.g. www-jangid-uk

• Create two more folder in this directory

  • www-jangid-uk

    • bin

    • default

      Example:

      

• Create some files

  • bin folder

    • setup_handler.py

      Example:

      

  • default folder

    • setup.xml
    • app.conf

    • restmap.conf

      Example:

      

setup.xml

Copy the below XML contents and paste to setup.xml file

<setup>
  <block title="Initial Setup Configuration">
    <text>Setup page with custom endpoints and user details</text>
  </block>

  <block title="User Information" endpoint="mycustom/customendpoint" entity="onetime_setup">

    <input field="appname">
      <label>Enter Splunk App name</label>
      <type>text</type>
    </input>

    <input field="username">
      <label>Enter Username</label>
      <type>text</type>
    </input>

    <input field="password">
      <label>Enter Password</label>
      <type>text</type>
    </input>

  </block>

  <block title="Splunk Instance Endpoints" endpoint="mycustom/customendpoint" entity="onetime_setup">

  <input field="my_bool_variable">
    <label>Select this if you want to use boolean</label>
    <type>bool</type>
  </input>

    <input field="host">
      <label>Enter the hostname or IP Address</label>
      <type>text</type>
    </input>

    <input field="port">
      <label>Enter the port number</label>
      <type>text</type>
    </input>

  </block>

</setup>

restmap.conf

Copy below contents and paste to restmap.conf file. These custom end points are required by setup page. You can also access these endpoints by ReST API

#
# These endpoint are used by setup page
#
[admin:myendpoint]
match=/mycustom
members=customendpoint

[admin_external:customendpoint]
handlertype = python
handlerfile = setup_handler.py
handleractions = list, edit

app.conf

copy below contents paste to app.conf of default folder

#
# Splunk app configuration file
#

[install]
is_configured = 0
install_source_checksum = 01bd6f5fce6e89948b5c3b6f4757db2a3001250c


[ui]
is_visible = 1
label = Splunk Setup Page

[launcher]
author = Manoj Jangid
description = Sample setup app for Splunk
version = 1.0

setup_handler.py

copy below python code inside your setup_handler.py file

import os import splunk.admin as admin import splunk.entity as en import splunk.Intersplunk

class ConfigApp(admin.MConfigHandler):
    def setup(self):
        if self.requestedAction == admin.ACTION_EDIT:
            for arg in ['username', 'password', 'host', 'port', 'appname', 'my_bool_variable']:
                self.supportedArgs.addOptArg(arg)

    def handleList(self, confInfo):
        confDict = self.readConf("anyfile")
        if None != confDict:
            for stanza, settings in confDict.items():
                for key, val in settings.items():
                    if key in ['my_bool_variable']:
                        if int(val) == 1:
                            val = '1'
                        else:
                            val = '0'
                    if key in ['username'] and val in [None, '']:
                        val = ''
                    if key in ['password'] and val in [None, '']:
                        val = ''
                    if key in ['host'] and val in [None, '']:
                        val = ''
                    if key in ['port'] and val in [None, '']:
                        val = ''
                    if key in ['appname'] and val in [None, '']:
                        val = ''
                    confInfo[stanza].append(key, val)

    def handleEdit(self, confInfo):

        if self.callerArgs.data['password'][0] in [None, '']:
            self.callerArgs.data['password'][0] = ''

        if self.callerArgs.data['username'][0] in [None, '']:
            self.callerArgs.data['username'][0] = ''

        if self.callerArgs.data['host'][0] in [None, '']:
            self.callerArgs.data['host'][0] = ''

        if self.callerArgs.data['port'][0] in [None, '']:
            self.callerArgs.data['port'][0] = ''

        if self.callerArgs.data['appname'][0] in [None, '']:
            self.callerArgs.data['appname'][0] = ''

        if int(self.callerArgs.data['my_bool_variable'][0]) == 1:
            self.callerArgs.data['my_bool_variable'][0] = '1'
        else:
            self.callerArgs.data['my_bool_variable'][0] = '0'

        self.writeConf('anyfile', 'onetime_setup', self.callerArgs.data)

# initialize the handler
admin.init(ConfigApp, admin.CONTEXT_NONE)

Default Data

To set the default data in setup page you need to create a custom configuration file to Splunk App's default directory.

create a file with name anyfile.conf into default directory and paste the below contents to /default/anyfile.conf file

[onetime_setup]
username = admin
password = admin123
host = 127.0.0.1
port = 8089
appname = www-jangid-uk
my_bool_variable = 0

Package the App

Packaging of Splunk app is very easy. Please follow below steps to create Splunk App on Windows or Linux platform

Creating SPL file on Windows Platform

SET PATH="C:\Program Files\7-Zip\";%PATH%
7z a -ttar www-jangid-uk www-jangid-uk
7z a -tgzip www-jangid-uk.spl www-jangid-uk.tar
DEL /Q www-jangid-uk.tar

Creating SPL file on Linux Platform

tar -cvf www-jangid-uk.tar ./www-jangid-uk/*
mv www-jangid-uk.tar www-jangid-uk.spl

Install the App

Install Splunk App manually Copy www-jangid-uk folder and paste to %SPLUNK_HOME%/etc/apps/ directory and restart the Splunk

# Windows Platform - Go to %SPLUNK_HOME%/bin directory
cd C:\Program Files\Splunk\bin\Splunk.exe
# Restart the Splunk
splunk.exe restart

Install Splunk App using Splunk Web

Packaging phase will create www-jangid-uk.spl file and we need to provide this file to Splunk Manager to install. Here are the all steps to install the app:

1. Login to Splunk Web
2. Go to Manage Apps
3. Install app from file
4. Select www-jangid-uk.spl
5. Click on upload
6. Restart the App

Test the App

Once you installed the app and Splunk is restarted, click on the Splunk Setup Page, it'll take you the setup page enter the value and click on the save.

A new file anyfile.conf will create in Splunk local directory with updated value.

Download the App

1. Download from Here - Click here download
2. Download from Splunkbase - Click here download

Question or Feedback?

Note

If you want to ask anything related this post, please tweet your question or feedback @JangidUK I will try to respond as soon as possible.