SplunkLive Brisbane Splunk for Developers
1 like111 views
This document provides information for developers about using Splunk. It discusses how Splunk can help with development workflows by providing visibility across the development toolchain. It explains what types of data can be analyzed in Splunk, including code review logs, version control logs and APIs, build logs, and task tracking logs. The document then discusses building Splunk apps, noting that anyone can be a Splunk app developer. It outlines the various ways developers can build apps, including using the REST API, SDKs, and XML. The document walks through building a sample app that finds data, gets it into Splunk, searches it, and visualizes it. It concludes by providing resources for developers to learn more about building apps with Splunk
SplunkLive Brisbane Splunk for Developers
- 1. Grigori Melnik, Principal Product Manager – Splunk Developer Platform Copyright © 2015 Splunk Inc. Splunk for Developers Matthew Erbs Brisbane matthewerbs github/merbla
- 2. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 2 How can Splunk help me? 2
- 3. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 3 A day in the life of a dev • Code • Build • Test • Package • Release • Configuration • Monitor
- 4. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 4 4 CI / Build Servers Project and Issue Tracking Code Repository QA / Testing Tools End-To-End Visibility Across The Dev Tool Chain Deployment Servers / Automation
- 5. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 5 CI / Build Server Code Review Task Tracking What Data Can You Splunk? Logs – Which code has already been reviewed for this release/sprint? Who has completed the most code reviews? What code has NOT been reviewed? Logs/API – Who is changing files? What kinds of files are being changed? What branches are most active? What types of activities are occurring for a branch? Version Control Logs/API – How many builds completed today/this week/this month? Which check-in kicked off this build? Which tests ran against this failed build? Logs – Which tasks are assigned to which developers? What progress is being made to complete assigned tasks? What tasks remain for this release/sprint? 5
- 6. Grigori Melnik, Principal Product Manager – Splunk Developer Platform Copyright © 2015 Splunk Inc. Building Splunk Apps
- 7. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 7 Who is a developer? 7
- 8. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 8 Everyone can be a Splunk App Developer! 8
- 9. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 9 Splunk for Application Developers 9 REST API Build Splunk Apps Extend and Integrate Splunk Simple XML JavaScript/CSS Extensions .Net JavaScript Python Ruby Java PHP Data Models Search Extensibility Modular Inputs SDKs KV Store
- 10. Grigori Melnik, Principal Product Manager – Splunk Developer Platform Log directly to Splunk via HTTP, TCP, UDP Integrate search results with other applications using custom visualizations Create and run searches from other applications The REST API and SDKs 10 VisualizeSearch Manage Add/Delete Users Manage Inputs Index
- 11. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 11 The Splunk REST API Exposes an API method for every feature in the product – Whatever you can do in the UI – you can do through the API – Index, Search, Visualize, Manage API is RESTful – Endpoints are served by splunkd – Requests are GET, POST, and DELETE HTTP methods – Responses are Atom XML & JSON – Versioning as of Splunk 5.0 – Search results can be output in CSV/JSON/XML 1
- 12. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 12 What does a Splunk App look like?
- 13. Grigori Melnik, Principal Product Manager – Splunk Developer Platform Copyright © 2015 Splunk Inc. Lets build an app…
- 14. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 14 • Find some data • Get the data into Splunk • Search for the Data • Visualise the data The Plan
- 15. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 15 The Data
- 16. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 16 The Modular Input
- 17. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 17 Static Data/Lookups
- 18. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 18 A Custom Search Command geodistance latA=MyLat lngA=MyLong latB=Ferry.Latitude lngB=Ferry.Longitude meters=distance | where distance <1000
- 19. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 19 The Visualisation
- 20. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 20 Some parting thoughts… • Help yourself (modular input errors) • Source control • Build Process • Continuous Integration & versioning
- 21. Grigori Melnik, Principal Product Manager – Splunk Developer Platform Copyright © 2015 Splunk Inc. Resources
- 22. Grigori Melnik, Principal Product Manager – Splunk Developer Platform 22 Where to go for more Info • Tutorials, Code Samples, Getting Started, Downloads – http://dev.splunk.com • Splunk Developer Guidance – http://dev.splunk.com/goto/devguide • Splunk Base (Apps) – https://splunkbase.splunk.com • GitHub – https://github.com/splunk • Twitter – https://twitter.com/splunkdev • Blogs – http://blogs.splunk.com/dev 22
- 23. Copyright © 2015 Splunk Inc.23 SEPT 26-29, 2016 WALT DISNEY WORLD, ORLANDO SWAN AND DOLPHIN RESORTS • 5000+ IT & Business Professionals • 3 days of technical content • 165+ sessions • 80+ Customer Speakers • 35+ Apps in Splunk Apps Showcase • 75+ Technology Partners • 1:1 networking: Ask The Experts and Security Experts, Birds of a Feather and Chalk Talks • NEW hands-on labs! • Expanded show floor, Dashboards Control Room & Clinic, and MORE! The 7th Annual Splunk Worldwide Users’ Conference PLUS Splunk University • Three days: Sept 24-26, 2016 • Get Splunk Certified for FREE! • Get CPE credits for CISSP, CAP, SSCP • Save thousands on Splunk education!