Using Splunk as a data store for developers

A number of years ago, I wrote a blog entry called Everybody Splunk with the Splunk SDK, which succinctly encouraged developers to put data into Splunk for their applications and then search on the indexed data to avoid doing sequential search on unstructured text. Since it’s been a while and I don’t expect people to memorize the dissertations of ancient history (to paraphrase Bob Dylan), I’ve decided to write about the topic again, but this time in more detail with explanations on how to proceed.

Why Splunk as a Data Store?

Some may proclaim that there are many no-sql like data stores out there already, so why use Splunk for an application data store? The answers point to simplicity, …

» Continue reading

My experience of building Splunk application

I joined Splunk a couple weeks ago and my first challenge was to learn everything I could about how to build Splunk applications. The best way of doing that is just to write your own application – and this is exactly what I did.

Application which I wrote contains two parts. The first part of application is a very simple scripted input for Firebase, the second part of application is built with the Splunk Web Framework that shows you objects and their routes on Google Maps using both real-time or playback historic information.

I hope that my experience can give you some thoughts about how you can extend Splunk for your needs.…

» Continue reading

The Splunk SDK for Python gets modular input support

Support for modular inputs in Splunk 5.0 and later enables you to add new types of inputs to Splunk that are treated as native Splunk inputs.

Last week Jon announced updates to the Splunk SDKs for Java, Python, and JavaScript, now we’ll take a deep dive into modular input support for the Splunk SDK for Python.

The latest release of the Splunk SDK for Python brings modular input support. The Splunk SDKs for C# (see Developing Modular Inputs in C#) and Java also have this functionality as of version and 1.2, respectively. The Splunk SDK for Python enables you to use Python to create new modular inputs for Splunk.

Getting started

The Splunk SDK for Python comes …

» Continue reading

Playing with the Splunk C# SDK–from PowerShell

As those who know me know, I Am Not A Developer. I could convincingly play one on TV, but that’s not the point. The point is this: I don’t have a copy of Visual Studio, and I don’t want to! When in Windows, PowerShell is my language of choice (and for good reason). This blog post will show you, in pretty short order, how to take the newly released Splunk SDK for C#, and use it to connect to a Splunk search head or indexer, but doing so from PowerShell instead of C#.

First, let me acknowledge that we do have a very cool Splunk PowerShell Resource Kit that you can download today. It includes over 40 PowerShell-Splunk cmdlets …

» Continue reading

Developing Modular Inputs in C# – Part 1

One of the cool new features of Splunk 5.0 is modular inputs, and we’ve already seen some great examples of this, such as the built-in perfmon gathering modular input and the Splunk Addon for PowerShell. However, the examples that are provided in the documentation are in Python. When I started writing my own modular input, I saw that much of the process of writing a modular input is scaffolding and repeatable. Thus I set out to write an SDK that would alleviate much of the scaffolding and provide a good framework for writing modular inputs. This multi-part series will cover the same process by writing a C# version of the Twitter example from the documentation.

» Continue reading

Splunk components for Apache Camel

Recently David Turanski from SpringSource and myself held a joint webinar on Extending Spring Integration for Splunk.

The developer feedback was great , and no feedback is better than when an audience member gets inspired to go and create and new set of Splunk components for another enterprise Java framework , in this case Apache Camel.

Similarly to Spring Integration , Apache Camel is an open-source integration framework based on Enterprise Integration Patterns. The programming semantic  to which the developer builds their integration solution with the respective frameworks will differ, and for this reason the developer may prefer one framework over the over , but the high level approach is the same, that being a development framework that …

» Continue reading

Spring Integration Splunk Adaptors Webinar

With the introduction of our various programming language SDK’s (Java, JS, Python,PHP,Ruby) for the Splunk REST API , we have significantly  lowered the barrier of entry for developers wanting to build big data apps and integrations on top of the Splunk platform.Developers can now choose their preferred development language and right out the blocks focus on coding their core business logic without having to worry about the lower level semantics of REST , the SDK’s make this easy.

And that is after all why we build tools and  frameworks in the first place , to make it simpler for you to perform some task and get to that point of productivity faster.

Building upon this ideal, if an SDK makes …

» Continue reading

Alternate JVM languages and the Splunk Java SDK

Speaking of Java as a language as opposed to the JVM platform, James Gosling, the Father of Java, said “Most people talk about Java the language, and this may sound odd coming from me, but I could hardly care less.”
He went on to explain, “What I really care about is the Java Virtual Machine as a concept, because that is the thing that ties it all together.”
- Quoted from

Alternate JVM languages are gaining momentum all over the place. These are languages that are focused on a particular paradigm, semantic ,programming style  or perhaps fill a niche roll that is better suited to coding in Java.

  • Scala
  • Groovy
  • Clojure
  • Jython
  • JRuby
  • Javascript(Rhino)
  • More here

We are  spoiled …

» Continue reading

RSS Inputs and Also the Splunk Java SDK

By now, some of you over the years may have downloaded from Splunkbase my reference implementation for using scripted input to index RSS feeds or have read about the topic. The idea is that this input is very low in daily volume (possibly in KBs/day as opposed to MBs/day), but presents itself with many different correlation opportunities from the same Splunk console. This was originally written in Python and used the publicly available to download and parse the RSS feed. The issues I have heard over time are some people are not allowed to install Python on a forwarder machine, have the wrong version of Python that may not work with or simply have issues with the …

» Continue reading

Eloqua PHP SDK

As part of our continuing open-source efforts here at Splunk, we’ve released the Eloqua PHP SDK that we’re using internally under the Apache License, version 2. We’re always very excited whenever we can contribute code back to the community, and this is certainly no exception! The SDK abstracts away a lot of the complexity inherent in dealing with SOAP, allowing developers to focus strictly on the API itself. The SDK also provides a workaround for a PHP bug in the native SOAP client where constructors don’t get called when instantiating classes mapped to SOAP types.

The tarball is available on Google Code, and example code for every SOAP method call is available in the documentation.…

» Continue reading