Building Splunk Hello World Application
Over the past couple of years I’ve been diving into the Splunk Ecosystem. Throughout my journey I often get asked from students how to get started with Splunk. I’ve got quite a few Splunk courses around the subject but the most basic way to get started is by building a Splunk Application. At the heart of learning any new programming language or technology is the Hello World Application. In Splunk that consist of building your first dashboard using data from a local machine. Let’s jump through building our first Splunk Hello World Application.
Getting Splunk Started
Before we start building our Splunk Hello World Application you need to have it installed. If you don’t already have Splunk installed head over to Splunk download and install based on your systems requirements. If you would like a detail overview of how to install checkout my Installing and Configuring Splunk course.
Splunk Local Data Import
Now that you have Splunk installed we need to find and import a data source. The quickest way for first time Splunk users to get data in their development environment is by using local data sources. All machines have local log files that can be parsed inside Splunk for information like application logs, audit logs, security logs, and more. Let’s follow the guided steps in Splunk for adding data.
- First click on Add Data from the Explore Splunk Enterprise screen
2. On the following screen we are presented with a lot of choices but let’s choose the Monitor files or ports on this Splunk platform instance option.
3. Now we are moved to another screen with a lot of options. Checkout the different monitoring types available for us without having to write any kind of regular expression to process like in the old days. For the Splunk Hello World Application let’s choose the Local Event Logs and Application and Security Event Logs
4. For the input settings keep the defaults Search & Reporting, Host Field Value, and Index = Default
5. Finally review that Application and Security event logs appear then click submit
6. Click Start Search
Reports with Splunk Left Sidebar
At this point we should have data streaming into our Splunk environment from local application and security event logs. If the defaults were selected during data upload your search command should display all the inside the Search Application.
Now we need to find some interesting insights from our data from the search screen. What about building an application to show the top logins on this machine? We can quickly pull this data by using the Splunk left sidebar.
- On the left sidebar click the field Account_Name
- Next within the Account_Name select from Reports Top Values
3. Following the first two steps should display a Visualization of the top 20 Account_Name logins on the machine.
source="WinEventLog:*" host="YOUR_HOSTNAME"| top limit=20 Account_Name
Create Splunk Dashboard Panel
Finally we are ready to build a Splunk Dashboard Panel which will be our Splunk Hello World Application. In the New Search that was created by our left sidebar report for Account_Name we have the option to Save As then walk through creating a dashboard panel of this search and visualization. Let walk through those steps.
- Select the Save As option in the right corner
2. Inside the Dashboard select New panel
3. Dashboard Panel Title Splunk Hello World Application
4. Dashboard Permission will be Private for now
5. Click Save
Congratulation you have just created your first Splunk Hello World Application!! Now you are ready to dive into more advanced Splunk topics like Splunk Processing Language or Splunk Transforming Commands. If you interested in working your way through a Splunk Learning Path make sure to checkout Pluralsight’s Splunk Fundamentals packed with 14 hours over 9 course on Splunk.