Splunk Add-on Builder

1. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
MAY 9, 2017 | ZURICH

2. © 2017 SPLUNK INC.
Add-on Build and Custom
Alert Actions
Philipp Drieger | Sr. Sales Engineer | SME BA IoT ML
MAY 9, 2017 | ZURICH

3. © 2017 SPLUNK INC.
During the course of this presentation, we may make forward-looking statements regarding future events or
the expected performance of the company. We caution you that such statements reflect our current
expectations and estimates based on factors currently known to us and that actual events or results could
differ materially. For important factors that may cause actual results to differ from those contained in our
forward-looking statements, please review our filings with the SEC.
The forward-looking statements made in this presentation are being made as of the time and date of its live
presentation. If reviewed after its live presentation, this presentation may not contain current or accurate
information. We do not assume any obligation to update any forward looking statements we may make. In
addition, any information about our roadmap outlines our general product direction and is subject to change
at any time without notice. It is for informational purposes only and shall not be incorporated into any contract
or other commitment. Splunk undertakes no obligation either to develop the features or functionality
described or to include any such feature or functionality in a future release.
Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in
the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved.
Safe Harbor Statement

4. © 2017 SPLUNK INC.
Add-on Builder
Accelerate your TA creation

5. © 2017 SPLUNK INC.
Add-on characteristics
▶ Technical extensions for Splunk
▶ May contain configurations, scripts,
data inputs, field extractions, reports
▶ Map and normalize fields, e.g. for
CIM compliance in Enterprise
Security
▶ Reusable in other apps
▶ Share on Splunkbase
What is a Splunk Add-on?

6. © 2017 SPLUNK INC.
Get started https://splunkbase.splunk.com
▶ Free download from Splunkbase
▶ UI driven workflow to create
Technical Add-ons
▶ Test and validate
▶ CIM mapping
▶ Quality check your TA for packaging
and publishing
▶ Create Custom Alert Actions
Splunk Add-on Builder

7. © 2017 SPLUNK INC.
▶ The Splunk Add-on Builder is only intended for use on a single-instance
development environment, such as a laptop
▶ Do not install the Splunk Add-on Builder app in a production Splunk environment
with real users
▶ Do not install the Splunk Add-on Builder app in a search head cluster or index
cluster environment
▶ Minimum Splunk 6.4 Enterprise, no support for Splunk Light
▶ Enterprise License not obligatory, however it is useful for working with more data
or check out the personal Splunk Developer License
Splunk Add-on Builder Notes
https://docs.splunk.com/Documentation/AddonBuilder/latest/UserGuide/Installation

8. © 2017 SPLUNK INC.
Demo
Add-on Builder

9. © 2017 SPLUNK INC.
Custom Alert Actions
Make your alerts actionable

10. © 2017 SPLUNK INC.
▶ Modular extension of alerts to customize actions and interface with 3rd party
systems and interfaces
What is a Custom Alert Action?
http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModAlertsIntro

11. © 2017 SPLUNK INC.
Demo
Custom Alert Actions

12. © 2017 SPLUNK INC.
SEPT 25-28, 2017
Walter E. Washington Convention Center
Washington, D.C.
.conf2017
The 8th Annual Splunk Conference
conf.splunk.com
You will receive an email after registration
opens with a link to save over $450 on the
full conference rate.
You’ll have 30 days to take advantage of
this special promotional rate!
SAVE OVER $450

13. © 2017 SPLUNK INC.
Take the Survey on Pony Poll
ponypoll.com/zurich2017

14. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
THANK YOU