Chapter 3. Enhancing Applications

In this chapter, we will focus on enhancing your App with branding elements, workflows, event types, tags, macros, data models, and more. None of these items are a strict requirement. However, they will definitely increase your appeal to end users and customers alike. Choosing elements that are memorable will cement your App in the minds of your users and will make your App shine. We will start with working with your data, and then move on from there to presenting your App with custom logos, navigation, CSS overrides, and other stock modifications of the SimpleXML dashboards. We will end this chapter by seeing how to use Splunk acceleration technologies and methods to speed up searches in large datasets. As we move into working with actual data, we will be using example data and real data. Some of the data here was consumed from the https://meh.com/ website. They have an API, and the data was collected every five minutes using a scripted input. This data...

Workflows

Workflows integrate with your data and are designed to help you move quickly through your data, or help you to integrate easily with other services. They can be used to drill down to another Splunk dashboard with prepopulated data in the request, perform an nslookup on an IP address in an event, open a ticket in an external ticket tracking system, or even launch an external search-all based on data found within the event. Workflows are displayed inline with the events you are working with. They don't have to apply for every single event. You can restrict a workflow to be revealed only when target events are listed, or a set of fields are listed. Workflows can be configured via the Web or configuration files.

Building a workflow in the web interface is straightforward. As part of our Splunk Developer's Guide (SDG) App, we will create a workflow that will interface with the http://mxtoolbox.com/ website to perform a reverse DNS lookup based on an IP address in the src_ip field found...

Custom alert actions

New in Splunk Enterprise 6.3, custom alert actions (also called modular alerts) allow a developer to define an integration that can be reused multiple times and in different ways based on the data being presented to it. Custom alert actions interact specifically with the alerts that were already present in Splunk. There are a few new components that go into making a custom alert action (let's call this a CAA). We will discuss the various components of a CAA and build a very simple CAA that will output the results of the search into a file within the App.

The first step in the creation of a CAA is to determine what your alert is intending to do. While it is possible for your alert to do multiple actions, do not try and combine multiple technologies unless necessary. For example, you wouldn't want to combine a Facebook action with a Twitter action, since both actions require separate authentication and authorization methodologies and credentials. Once you have narrowed...

Enriched data

Naturally, when we talk about enriched data, we are talking about separating the isotopes of our data and storing them in secure storage, right? Nope! No weapons-grade data here! The term enriched data refers to adding extra context to raw data. Therefore, the data is then enriched. We will now cover event types, tags, and macros.

Event types

Event types are used to classify similar events into categories. Categorizing events is important because it can help you search through a large amount of data quickly, find patterns, or create specific alerts and searches. They are defined by users via the GUI or via the command line, or they are part of a prepackaged app. Event types can have permissions assigned to them so that only specific roles can view or edit them. Defined event types will show up in the user's Field List during a search in the GUI and, as such, can be modified and searched just as a normal field can be. Event types are defined by a Splunk search. Let's create an...

Branding your App

Branding your App allows end users to know who you are and provides them with a consistent representation of your brand. Splunk offers almost limitless options for customization and brand creation within a Splunk App. SimpleXML provides a small subset of customization, and if you employ the full Splunk Developer's Kit (SDK), you will get limitless control over presentation and branding. There are a few guidelines for rebranding your App, and the most up-to-date information can be found at http://www.splunk.com/view/SP-CAAAFT9.

The guidelines are as follows:

• Keeping the Splunk logo in place and adding their text to the right of it, for example, Splunk> Foo where their add-on is named Foo. This is the recommended action when Splunk's visual elements are left mostly intact.

• Replacing the Splunk logo with the developer's logo and then slotting in the Splunk-Powered logo to the right. This is the recommended action when the developer creates a branded UI with a different look...

Acceleration

Splunk searches are fast. They can pull millions of events in a relatively small amount of time. However, what happens when you need to search billions of events? Also, what if you want the daily statistics of a website over 5 years? This is where some methods of acceleration will give you an advantage over raw data. Acceleration summarizes your data and provides you with aggregated statistics that can be looked up faster. If your App doesn't collect that much data, or you don't care about long-term statistics, you might not need any form of acceleration.

Summary indexing

Summary indexing is a tested but true method of collecting aggregated data. One way is to set up the summary fields and place them in the index using the collect command.

Note

Summary indexing does not count towards your daily license usage, so feel free to summarize as much data as you wish!

Let's start with the report manager. Before we begin configuring the summary index, we have to decide what we want to summarize...

Summary

In this chapter, we went through various methods of enriching data. By adding more tags, event types, and workflow actions to your App, you can provide various enhancements for your end users, creating a unified and seamless environment. We showed you how using lookups provides a means of enhancing data, and how you can start branding your App according to your specifications. We will elaborate on these customizations as we move forward. We also looked at some methods of accelerating data and provided an example of how to do so.

In the next chapter, we will start covering the use and configuration of SimpleXML views and dashboards. We won't delve extensively into SimpleXML, but will cover some basic visualizations and how to create and use a SimpleXML form.