2. Disclaimer
2
During the course of this presentation, we may make forward looking statements regarding future events or the
expected performance of the company. We caution you that such statements reflect our current expectations and
estimates based on factors currently known to us and that actual events or results could differ materially. For important
factors that may cause actual results to differ from those contained in our forward-looking statements, please review
our filings with the SEC. The forward-looking statements made in the this presentation are being made as of the time
and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or
accurate information. We do not assume any obligation to update any forward looking statements we may make. In
addition, any information about our roadmap outlines our general product direction and is subject to change at any
time without notice. It is for informational purposes only and shall not, be incorporated into any contract or other
commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include
any such feature or functionality in a future release.
16. What’s special about the new SDK?
18
Modern API, what C# developers will expect
100% asynchronous
Supports Reactive Extensions (great for realtime searches)
Cross Platform
Testable
17. Log directly to
Splunk and extend
Splunk with new
Inputs
Integrate search
results with other
applications using
custom
visualizations
Create and run
searches
Splunk SDK
19
VisualizeSearch Manage
Add/Delete Users
Manage Inputs
Index
21. Many choices for logging
http://aka.ms/slab
http://nlog-project.org
22. Splunk Logging Libraries for .NET
A tale of two loggers
ETW/SLAB.NET Tracing
24
App
Trace Listener
Splunk
Log to a
TraceSource
Events are sent
to or Splunk
via UDP or TCP
App
EventSource
Splunk
Log to ETW via
an EventSource
SLAB Sink
UDP or TCP sink
picks up events
via SLAB and
sends to Splunk
24. Logging Directly to Splunk
26
Everything you need to wire up your existing apps to log directly over
UDP or TCP to a Splunk instance or forwarder
Standard .NET Trace Listeners – use log4net, NLog and Enterprise
Library.
Support for the Semantic Logging Application Block (SLAB) – use the
the high performance ETW Windows infra
28. Splunk Extension for Visual Studio
30
Template for using the Splunk Client and logging libraries.
Template for creating a C# modular input.
Code snippets
31. 33
CC image Dorothy… not in Kansas by Alex Beattie Flickr
.NET is not the same platform you remember!!!
32. 34
…BUT
You have a new set of .NET tools for Splunk Development!
• Splunk SDK – Integrate with or extend Splunk
• Logging Libraries - Easily wire up your apps to send log data
• VS extension - Streamline your development with our new libraries
33. Where to go for More Info
• Tutorials, Code Samples, Getting Started, Downloads
– http://dev.splunk.com/
• Support
– https://www.splunk.com/page/submit_issue
• GitHub
– https://github.com/splunk/
• Twitter
– https://twitter.com/splunkdev or follow me: https://twitter.com/gblock
• Blog
– http://blogs.splunk.com/dev/
35
Splunk Enterprise is a robust, fully-integrated platform that enables developers to INTEGRATE data and functionality from Splunk software into applications across the organization using Software Development Kits (SDKs) for Java, JavaScript, C#, Python, PHP and Ruby. These SDKs make it easier to code to the open REST API that sits on top of the Splunk Engine. With almost 200 endpoints, the REST API lets developers do programmatically what any end user can do in the UI and more. The Splunk SDKs include documentation, code samples, resources and tools to make it faster and more efficient to program against the Splunk REST API using constructs and syntax familiar to developers experienced with Java, Python, JavaScript, PHP, Ruby and C#. Developers can easily manage HTTP access, authentication and namespaces in just a few lines of code.
Developers can use the Splunk SDKs to:
- Run real-time searches and retrieve Splunk data from line-of-business systems like Customer Service applications
- Integrate data and visualizations (charts, tables) from Splunk into BI tools and reporting dashboards
- Build mobile applications with real-time KPI dashboards and alerts powered by Splunk
- Log directly to Splunk from remote devices and applications via TCP, UDP and HTTP
- Build customer-facing dashboards in your applications powered by user-specific data in Splunk
- Manage a Splunk instance, including adding and removing users as well as creating data inputs from an application outside of Splunk
- Programmatically extract data from Splunk for long-term data warehousing
Developers can EXTEND the power of Splunk software with programmatic control over search commands, data sources and data enrichment.
Splunk Enterprise offers search extensibility through:
- Custom Search Commands - developers can add a custom search script (in Python) to Splunk to create own search commands. To build a search that runs recursively, developers need to make calls directly to the REST API
- Scripted Lookups: developers can programmatically script lookups via Python.
- Scripted Alerts: can trigger a shell script or batch file (we provide guidance for Python and PERL).
- Search Macros: make chunks of a search reuseable in multiple places, including saved and ad hoc searches.
Splunk also provides developers with other mechanisms to extend the power of the platform.
- Data Models: allow developers to abstract away the search language syntax, making Splunk queries (and thus, functionality) more manageable and portable/shareable.
- Modular Inputs: allow developers to extend Splunk to programmatically manage custom data input functionality via REST.
The Splunk SDKs empower developers to deliver greater operational agility throughout the enterprise by making it easy to integrate data from Splunk with other applications. Splunk provides a fully-documented and supported REST API with nearly 200 endpoints that let developers programmatically index, search and visualize data in Splunk from any application. Splunk’s SDKs, built on that API, make it easy for developers to integrate data from Splunk with other applications across the enterprise, from custom-built mobile reporting apps to off-the-shelf CRM solutions. Splunk offers SDKs for Python, Java, JavaScript, PHP, Ruby and C#.
Developers can use the Splunk SDKs to:
Run real-time searches and retrieve Splunk data from line-of-business systems like Customer Service applications
Integrate data and visualizations (charts, tables) from Splunk into BI tools and reporting dashboards
Build mobile applications with real-time KPI dashboards and alerts powered by Splunk
Log directly to Splunk from remote devices and applications via TCP, UDP and HTTP
Build customer-facing dashboards in your applications powered by user-specific data in Splunk
Manage a Splunk instance, including adding and removing users as well as creating data inputs from an application outside of Splunk
Programmatically extract data from Splunk for long-term data warehousing
Interact with data stored in Hadoop using HUNK