Using Splunk as a data store for developers
A number of years ago, I wrote a blog entry called Everybody Splunk with the Splunk SDK, which succinctly encouraged developers to put data into Splunk for their applications and then search on the indexed data to avoid doing sequential search on unstructured text. Since it’s been a while and I don’t expect people to memorize the dissertations of ancient history (to paraphrase Bob Dylan), I’ve decided to write about the topic again, but this time in more detail with explanations on how to proceed.
Why Splunk as a Data Store?
Some may proclaim that there are many no-sql like data stores out there already, so why use Splunk for an application data store? The answers point to simplicity, …
My experience of building Splunk application
I joined Splunk a couple weeks ago and my first challenge was to learn everything I could about how to build Splunk applications. The best way of doing that is just to write your own application – and this is exactly what I did.
Application which I wrote contains two parts. The first part of application is a very simple scripted input for Firebase, the second part of application is built with the Splunk Web Framework that shows you objects and their routes on Google Maps using both real-time or playback historic information.
I hope that my experience can give you some thoughts about how you can extend Splunk for your needs.…
The Splunk SDK for Python gets modular input support
Support for modular inputs in Splunk 5.0 and later enables you to add new types of inputs to Splunk that are treated as native Splunk inputs.
The latest release of the Splunk SDK for Python brings modular input support. The Splunk SDKs for C# (see Developing Modular Inputs in C#) and Java also have this functionality as of version 126.96.36.199 and 1.2, respectively. The Splunk SDK for Python enables you to use Python to create new modular inputs for Splunk.
The Splunk SDK for Python comes …
Playing with the Splunk C# SDK–from PowerShell
As those who know me know, I Am Not A Developer. I could convincingly play one on TV, but that’s not the point. The point is this: I don’t have a copy of Visual Studio, and I don’t want to! When in Windows, PowerShell is my language of choice (and for good reason). This blog post will show you, in pretty short order, how to take the newly released Splunk SDK for C#, and use it to connect to a Splunk search head or indexer, but doing so from PowerShell instead of C#.
First, let me acknowledge that we do have a very cool Splunk PowerShell Resource Kit that you can download today. It includes over 40 PowerShell-Splunk cmdlets …
Developing Modular Inputs in C# – Part 1
One of the cool new features of Splunk 5.0 is modular inputs, and we’ve already seen some great examples of this, such as the built-in perfmon gathering modular input and the Splunk Addon for PowerShell. However, the examples that are provided in the documentation are in Python. When I started writing my own modular input, I saw that much of the process of writing a modular input is scaffolding and repeatable. Thus I set out to write an SDK that would alleviate much of the scaffolding and provide a good framework for writing modular inputs. This multi-part series will cover the same process by writing a C# version of the Twitter example from the documentation.
Splunk components for Apache Camel
The developer feedback was great , and no feedback is better than when an audience member gets inspired to go and create and new set of Splunk components for another enterprise Java framework , in this case Apache Camel.
Similarly to Spring Integration , Apache Camel is an open-source integration framework based on Enterprise Integration Patterns. The programming semantic to which the developer builds their integration solution with the respective frameworks will differ, and for this reason the developer may prefer one framework over the over , but the high level approach is the same, that being a development framework that …
Spring Integration Splunk Adaptors Webinar
With the introduction of our various programming language SDK’s (Java, JS, Python,PHP,Ruby) for the Splunk REST API , we have significantly lowered the barrier of entry for developers wanting to build big data apps and integrations on top of the Splunk platform.Developers can now choose their preferred development language and right out the blocks focus on coding their core business logic without having to worry about the lower level semantics of REST , the SDK’s make this easy.
And that is after all why we build tools and frameworks in the first place , to make it simpler for you to perform some task and get to that point of productivity faster.
Building upon this ideal, if an SDK makes …
Alternate JVM languages and the Splunk Java SDK
Speaking of Java as a language as opposed to the JVM platform, James Gosling, the Father of Java, said “Most people talk about Java the language, and this may sound odd coming from me, but I could hardly care less.”
He went on to explain, “What I really care about is the Java Virtual Machine as a concept, because that is the thing that ties it all together.”
- Quoted from theserverside.com
Alternate JVM languages are gaining momentum all over the place. These are languages that are focused on a particular paradigm, semantic ,programming style or perhaps fill a niche roll that is better suited to coding in Java.
- More here
We are spoiled …
RSS Inputs and Also the Splunk Java SDK
By now, some of you over the years may have downloaded from Splunkbase my reference implementation for using scripted input to index RSS feeds or have read about the topic. The idea is that this input is very low in daily volume (possibly in KBs/day as opposed to MBs/day), but presents itself with many different correlation opportunities from the same Splunk console. This was originally written in Python and used the publicly available feedparser.py to download and parse the RSS feed. The issues I have heard over time are some people are not allowed to install Python on a forwarder machine, have the wrong version of Python that may not work with feedparser.py or simply have issues with the …
Eloqua PHP SDK
As part of our continuing open-source efforts here at Splunk, we’ve released the Eloqua PHP SDK that we’re using internally under the Apache License, version 2. We’re always very excited whenever we can contribute code back to the community, and this is certainly no exception! The SDK abstracts away a lot of the complexity inherent in dealing with SOAP, allowing developers to focus strictly on the API itself. The SDK also provides a workaround for a PHP bug in the native SOAP client where constructors don’t get called when instantiating classes mapped to SOAP types.