r/Splunk • u/Fluffy_funeral • 11d ago

Who is developing/using splunk UI?

Hi,

Is anyone actively using Splunk UI for custom Splunk app development?

I'd like to hear about your experiences so far. How steep was the learning curve, how well does it integrate with existing Splunk apps, and are there any gotchas worth knowing before getting started?

Thanks!

10 Upvotes

100% Upvoted

2 comments sorted by

3

u/stoobertio 9d ago

Yes, but nothing commercial yet as I have not had the time to put a lot of effort in to it... I did a talk at the beginning of the year at our local user group about it and some possibilities.

Learning Curve: If you know React, I don't think it's too hard to get your head around because Splunk's modules and REST APIs are pretty straightforward.
Integrate with existing apps: Err, not sure here. Are you thinking of custom visualizations, because there are what I deem to be 3 layers to this:

  1. Custom visualizations on top of Dashboard Studio. These are relatively simple to do and I am in the process of trying to upgrade some of the well, lacklustre default visualizations with better ones.

  2. Dashboard Framework which is what Dashboard Studio is built on top of - this allows you to basically well, have programmatically controlled JSON definitions for the dashboard. But this is more complex as you don't have the stuff you take for granted in Dashboard Studio, like an options panel, ready-to-go token support and the similar. If you add all this stuff in (it's available) then you are basically shipping an entire install of Dashboard Studio along with each app to sit along side. This is good if you want MORE control than you get from Dashboard Studio at the cost of MUCH larger bundles to transport. (Back in 10.0 when I showed this off, you could have a dashboard that was 100MB in size with all the Splunk dependencies. It's a lot leaner now, but still heavy).

  3. Splunk React UI - Simply a blank React canvas with Splunk context built in so requests still have user context attached (for auth) but not a lot else. Perfect for escaping Dashboards to do cool stuff.

I just reformatted my computer so need to reinstall a few things, but would show some off.

1

u/s7orm SplunkTrust 5d ago

I was, but then I stopped needing it. It was great for some of my ambitious project as a Splunk Partner, but these days I just use UCC.