Splunk Setup Page Builder
Build a certification-compliant first-run setup page for a Splunk app or add-on, using the configurations REST endpoint and storage/passwords instead of the deprecated setup.xml mechanism.Built by Splunk LLCInstallation
npx skills add splunk/splunk-agent-skills --skill splunk-setup-page-builderSkill instructions
Build a first-run setup page for a Splunk app or add-on: a screen that
appears the first time a user launches the app, collects whatever
configuration it needs (an endpoint URL, an API token, feature toggles,
etc.), and completes without using the deprecated setup.xml mechanism.
This is proven, not theoretical: the workflow below was built end-to-end
against a real Splunk Enterprise 10.4 instance, validated with
splunk-appinspect in both test and precert mode, and revised after
two real bugs were found during manual testing (see
Known pitfalls — do not
reintroduce either one). It was independently re-validated twice more by
fresh agent sessions with no prior context, each building a different toy
app from the instructions alone.
When to Use
Use this skill when a user is building a Splunk app/add-on for Splunkbase
(or an internal TA) that needs the user to provide configuration before it
can run — most commonly an API endpoint, credentials/token, or a small set
of feature settings — and wants a proper "Set up your app" experience
instead of hand-editing .conf files after install.
Do not use default/setup.xml for this. It is deprecated, unsupported on
Splunk Cloud Platform and search head clusters, and fails Splunk
AppInspect's cloud check (check_setup_xml_in_default) outright. Every
app that needs first-run configuration and wants to be Cloud-compatible
must use a setup view (Simple XML or React) instead, wired through
app.conf's [install] is_configured / [ui] setup_view.
Do not install or reconfigure a production or shared Splunk instance unless the user explicitly confirms that target. Never ask the user for raw Splunk admin credentials — use whatever session/auth Splunk Web already provides via the JS SDK.
Stay scoped to building the setup page itself. Route adjacent requests:
- General app/add-on packaging, compatibility, upgrade, deprecation, or
removal guidance not about the setup page →
app-and-add-on-lifecycle-advisor(advisory-only; it will not write or install anything — this skill remains the one that actually builds the setup page). - Governance of existing shared knowledge objects (ownership, orphans, ACL
review, naming collisions) beyond this app's own
default.meta→knowledge-object-governance. - HEC or other data-ingestion setup/troubleshooting →
hec-setup-and-troubleshooting. - Authoring field extractions, CIM mappings, or ad hoc SPL unrelated to the
setup page →
field-extraction-and-cim-mappingorsplunk-search. - General Splunk product questions unrelated to setup pages →
splunk-product-question-navigator.