-
Install Splunk Enterprise and Add-on Builder
- Enterprise Free Trial: https://www.splunk.com/en_us/download/splunk-enterprise.html
- Splunk Add-on Builder: https://splunkbase.splunk.com/app/2962
-
Clone the repository, then run
./build.shto build the SPL and finally install the SPL through "Manage Apps". -
Open Add-on Builder in Splunk, find runZero Asset Sync in "Other apps and add-ons" and select "Validate & Package".
- Don't use "Import Project" in the first tab of the Add-on Builder!!! This is useful for testing/developing, but it will silently alter several files and break functionality. For example, it will change the case of the package/settings names in a way that is backwards incompatible with older versions of the add-on. It will also remove the api_key/api_endpoint account settings, and replace them with username/password. Despite the tempation, don't use this option.
- Validation could take a few minutes to finish.
- If any errors are reported, correct and then re-validate.
-
Download the validated SPL from the Add-on Builder.
-
In Splunkbase, under "My Apps" select "Manage App" and then select "In Splunkbase Classic". After, on the version listing, select "New Version".