This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10
Welcome to the Splunk Developer manual. This manual contains instructions on developing for Splunk, from changing Splunk's appearance to integrating Splunk with 3rd party applications. Primarily, this manual focuses on customizing Splunk's UI and building apps.
At a high level, an app is a workspace that solves a specific use case for your company. For example, a single Splunk install can run a helpdesk app, a business analytics app, the Windows app and the Search app, all at the same time. Apps:
Apps let you construct and maintain different environments on top of one Splunk instance. One Splunk installation can run multiple apps. This way, any number of different groups can use the same Splunk instance without running into each other.
For example, you can make an app for all your helpdesk employees and a different app for your marketing department. When a user in the helpdesk role logs into Splunk, they'll see a customized environment that helps them track their support cases. When a user from the marketing group logs in, they'll see the business analytics app, where they can run reports on business trends and web activity. Meanwhile, the Splunk admin can maintain all the installed apps, as well as build and install more.
By building apps, you can create separate contexts for the different groups of Splunk users within your organization: one app for troubleshooting your email servers, one app for analyzing business trends, and so on. This way, everyone can use the same Splunk instance, but see only data that is relevant to their interests. Some groups can access multiple apps while some may see only one. apps are highly customizable, so you get to decide who sees what and how it works.