Building Splunk VisualizaDons with the New Custom VisualizaDon API

Size: px

Start display at page:

Download "Building Splunk VisualizaDons with the New Custom VisualizaDon API"

Nelson Booth
5 years ago
Views:

2 Disclaimer During the course of this presentadon, we may make forward looking statements regarding future events or the expected performance of the company. We caudon you that such statements reflect our current expectadons and esdmates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC. The forwardlooking statements made in the this presentadon are being made as of the Dme and date of its live presentadon. If reviewed a>er its live presentadon, this presentadon may not contain current or accurate informadon. We do not assume any obligadon to update any forward looking statements we may make. In addidon, any informadon about our roadmap outlines our general product direcdon and is subject to change at any Dme without nodce. It is for informadonal purposes only and shall not, be incorporated into any contract or other commitment. Splunk undertakes no obligadon either to develop the features or funcdonality described or to include any such feature or funcdonality in a future release. 2

3 Agenda Why Use Custom VisualizaDons Custom VisualizaDons in Splunk Overview of the API Coding Demo Learning More 3

4 Why VisualizaDon MaZers Splunk excels at understanding machine data 4

5 Why VisualizaDon MaZers Humans are excellent at seeing visual pazerns 5

6 VisualizaDon bridges the gap Why VisualizaDon MaZers 6

7 Splunk has built-in visualizadons for many of the most common data types and tasks Built-In VisualizaDons 7

8 Splunk has built-in visualizadons for many of the most common data types and tasks Built-In VisualizaDons 8

9 The visualizadon framework makes it possible for Splunk users to bring in any visualizadon they want Custom VisualizaDons 9

10 Quick Demo 10

11 Splunk Supported VisualizaDons We built a set of supported visualizadons to both address some of the top requests, and to serve as samples for developers Sankey Diagram Treemap Timeline Punchcard Calendar Heatmap Horseshoe Meter Status Indicator Horizon Chart LocaDon tracker Parallel Coordinates Bullet Chart But that is just the Dp of the iceberg the real power is the API 11

12 Custom VisualizaDons in Splunk Packaged in apps Available across Splunk (Search, dashboards, reports, other apps) Permissioned like all Splunk knowledge objects Can be found and installed from the Splunk UI Implemented in JavaScript using any framework a developer wants 12

13 A Custom VisualizaDon App appname appserver stadc visualizadons <visualizadon_name> visualizadon.js visualizadon.css formazer.html default visualizadons.conf 13

14 JavaScript SplunkVisualizaDonBase Main entrypoint for logic and rendering Extend in visualizadon.js Override data handling and rendering methods SplunkVisualizaDonUDls UDliDes for color schemes, Dmezone handling, boolean normalizadon, and security best-pracdces 14

15 formazer.html Contains html for the viz editor dialog Property values get picked up and passed to JavaScript Supports Splunk-style form elements as webcomponents Also supports html inputs 15

16 visualizadon.css Contains css rules for the visualizadon 16

17 visualizadons.conf System-wide configuradon for the visualizadons User-facing labels User help strings Default height Selectability Can declare muldple vizes per app 17

18 Webpack We strongly suggest using webpack to build visualizadons into a contained package 18

19 A Custom VisualizaDon App with Webpack appname appserver stadc visualizadons <visualizadon_name> src visualizadon_source.js webpack.config.js visualizadon.js visualizadon.css formazer.html package.json default visualizadons.conf 19

20 Coding Demo 20

21 Learning More Related breakout sessions and acdvides What's New Custom Visualiza4ons: Michael Porath Dashboards, Aler4ng, Repor4ng and Visualiza4on - What s New: Michael Porath and Nicholas Filippi STEP up your app development game: Tedd Hellmann and David Poncelow Dashboard Wizardry: Siegfried Puchbauer and Nicholas Filippi Faster Splunk App Cer4fica4on with Splunk AppInspect: Grigori Melnik and Andrew Nortrup Best Prac4ces for Developing Splunk Apps and Add-ons: Jason Conger Visualiza4on and dashboard clinics and booths on the show floor 21

22 Learning More Online Resources Custom VisualizaDon Overview Step-by-Step Tutorial API Reference Examples on SplunkBase Code From this Talk 22

23 THANK YOU

Sierra- Cedar s Best PracDces for Building a Security OperaDons Center

Copyright 2015 Splunk Inc. Sierra- Cedar s Best PracDces for Building a Security OperaDons Center Robert Miller Manager Corporate Security, Sierra- Cedar, Inc. Disclaimer During the course of this presentadon,