Latest SplunkBase Applications (Splunk)

App Deployment

welbymcroberts — Thu, 08 Jan 2009 14:08:01 +0000

This application provides a way to distribute applications via the Deployment Server. Currently (3.4.3) the deployment server creates a tar file (as .bundle) for each application, and stores the configuration and discards the rest of the file. This script runs as a scripted input as a one-shot at startup. The script will go through each bundle that has been distributed to the instance, checks to see if a bin/ directory exists, checks the 'checksum' against the .checksum file within the instances etc/apps/APPNAME/ directory, if the file doesn't exist or the checksum does not equal that of the bundle the bin/ directory is extracted to the instances etc/apps/APPNAME/ directory.

Splunk Assist Application

Splunk — Tue, 14 Oct 2008 17:50:11 +0000

The Splunk assist application is to be used for troubleshooting, monitoring, and enhancing the performance of Splunk. The application contains a group of files that contains searches and configuration options that will assist in your use of Splunk.

Splunk License Usage

joshs — Mon, 23 Jun 2008 15:55:31 +0000

This bundle provides a new dashboard which has several widgets that query to help you determine your Splunk license usage total over the past 24 hours as well as usage by host, source, and sourcetype. It contains timecharts to help you understand usage over time and see usage spikes as well as pie charts to help you to figure out which log files, sourcetypes, and hosts Splunk is indexing the most data from.

Splunk Replay

Splunk — Sat, 26 Apr 2008 21:28:56 +0000

Inspired by glTail.rb and Digg Lab’s Stack, Splunk Replay is a Flash-based, data visualization tool which “replays” your Splunk'd logfile activities in an animated layout. Replay generates animated barchart graphs using two extracted fields from the events it receives from Splunk. For example, if you have Splunk eat wiki data, you can plot the wiki user and wiki page they are editing, and then animate those relationships over a given time range. Events particles are emitted from rows on the y-axis and stack up in columns x-axis. When a new row value is created, a random color is assigned to it for the duration of the session. These colors are then used in stacked bars to illustrate the amount of activity for a given row value. Older values on both axis are cycled out if more room is needed for newer data. More information, and instructions for installing replay can be found on the developer's wiki: http://code.google.com/p/splunk-flash/wiki/SplunkReplay

Splunk License Usage

joshs — Mon, 23 Jun 2008 15:55:31 +0000

Convert 2.2.x conf files to 3.x

araitz — Fri, 14 Mar 2008 19:03:26 +0000

Here's a script I wrote to convert 2.2 livesplunks.conf and savedsplunks.conf, cleaners.xml, and props.conf into 3.x savedsearches.conf, segmenters.conf, and props.conf. I hope to improve and add to it, so let me know if you have any ideas, or just go ahead and do it

Perl PDF Report Creator "Search Command"

aspina — Mon, 14 Jan 2008 21:35:28 +0000

Create customizable PDF reports using this perl script, which includes the Intersplunk.pm module written by Andrew Hoying. Some knowledge of Perl required to install the Perl PDF modules available via CPAN.

Perfgraph

rdas — Fri, 12 Oct 2007 01:05:09 +0000

A Splunk performance visualization search processor. See my blog for more information.

Enable SSL in Splunk

deeann — Tue, 02 Oct 2007 20:22:09 +0000

A quick and simple add-on that enables SSL for your pre-3.2 Splunk server and Web interface.

Splunk internal front end development bundle

nick — Sat, 01 Sep 2007 00:18:05 +0000

This bundle right now just implements a simple dashboard to keep track of some simple Front end things around the Splunk interface itself. Searches on this dashboard show last-24-hours charts of - Splunk logins, splunk searches executed, indexing throughput, and longest query time. NOTE: this bundle is more notable probably because it shows how you can bundle a dashboard. HOWEVER the configuration for dashboards will still undergo a very significant amount of change, so beware that this area will require more maintenance than most... =)