Chapter 9. App Creation and Consolidation

In this chapter, we will focus on how to not only create an app, but also to add functionality to it by consolidating functions from other apps on Splunk base. The advantage to this is that it enables users to leverage operations such as a Lightweight Directory Access Protocol (LDAP) search, or a different event type in a custom app that is being created for a proprietary purpose. You can also create apps in context with the data that is being viewed, and all knowledge objects can be permissioned appropriately. Maybe you want to create an app for your engineering staff for Windows and Linux, and you don't want to clutter your launcher page with any more apps because you've installed a plethora of them already. I'm going to show you some techniques for how to do this at the indexing and search head levels, so that you can keep your administrative overhead as low as possible. We will learn about:

• Types of app...