Run a Splunk server with Add-on Builder

README.md

Splunk with Add-on Builder

This gist runs a standalong Splunk server with Add-on Builder pre installed. This is the simplest way to start developing a Splunk Add-on.

Instructions

Step 1. Install Docker Desktop

• Docker Destop Mac
• Docker Desktop Windows

This includes Docker Compose which we will use in the next steps.

Step 2. Save this gist

Create a directory called splunk-with-addon-builder and save the file docker-compose.yml from this gist to the directory.

Step 3. Set your SplunkBase credentials

In the file docker-compose.yml you saved, set the variables SPLUNKBASE_USERNAME and SPLUNKBASE_PASSWORD to your SplunkBase credentials. This will allow Add-on Builder (or any other apps) to be downloaded from SplunkBase automatically.

Step 4. Start the server

In a terminal, enter the directory and use Docker Compose to start the server:

cd splunk-with-addon-builder
docker-compose up

Step 5. Connect to the server

Wait about 5 minutes for the server to come up, then point your browser to http://localhost:8000

Login with username admin and password password. (To change the password, you can set the SPLUNK_PASSWORD variable in the docker-compose.yml file and restart the server)

When you're done with the server, return to the terminal and press Ctrl-C to stop the server. All changes will be saved.

Uninstall

To remove the server or clear the data to start over, open a terminal, then enter the directory and use Docker Compose to delete the containers and volumes:

cd splunk-with-addon-builder
docker-compose down -v

docker-compose.yml

version: '3.7'

volumes:
  splunk-etc:
  splunk-var:

services:
  splunk:
    image: splunk/splunk:8.1
    hostname: splunk
    volumes:
      - splunk-etc:/opt/splunk/etc
      - splunk-var:/opt/splunk/var
      - ./Splunk.License:/splunk.lic
    environment:
      - SPLUNK_START_ARGS=--accept-license
      - SPLUNK_PASSWORD=password
      - SPLUNK_LICENSE_URI=/splunk.lic
      - SPLUNK_APPS_URL=https://splunkbase.splunk.com/app/2962/release/3.0.1/download
      - SPLUNKBASE_USERNAME=<your-splunkbase-username>
      - SPLUNKBASE_PASSWORD=<your-splunkbase-password>
    ports:
      - 127.0.0.1:8000:8000
      - 127.0.0.1:8089:8089