Defining an app

In the strictest sense, an app is a directory of configurations, and sometimes code. The directories and files inside have a particular naming convention and structure.

All configurations are in plain text and can be edited using your choice of text editor. Apps generally serve one or more of the following purposes:

  • Acting as a container for searches, dashboards, and related configurations: This is what most users will do with apps. This is useful not only for logical grouping but also for limiting what configurations are applied and at what time. This kind of app usually does not affect other apps.
  • Providing extra functionality: Many objects can be provided in an app for use by other apps. These include field extractions, ...

Get Implementing Splunk 7 - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.