Skip to main content
Splunk Setup Page Builder skill icon

Splunk Setup Page Builder

Build a certification-compliant first-run setup page for a Splunk app or add-on, using the configurations REST endpoint and storage/passwords instead of the deprecated setup.xml mechanism.Built by Splunk LLC

Installation

npx skills add splunk/splunk-agent-skills --skill splunk-setup-page-builder

Skill instructions

Build a first-run setup page for a Splunk app or add-on: a screen that appears the first time a user launches the app, collects whatever configuration it needs (an endpoint URL, an API token, feature toggles, etc.), and completes without using the deprecated setup.xml mechanism.

This is proven, not theoretical: the workflow below was built end-to-end against a real Splunk Enterprise 10.4 instance, validated with splunk-appinspect in both test and precert mode, and revised after two real bugs were found during manual testing (see Known pitfalls — do not reintroduce either one). It was independently re-validated twice more by fresh agent sessions with no prior context, each building a different toy app from the instructions alone.

When to Use

Use this skill when a user is building a Splunk app/add-on for Splunkbase (or an internal TA) that needs the user to provide configuration before it can run — most commonly an API endpoint, credentials/token, or a small set of feature settings — and wants a proper "Set up your app" experience instead of hand-editing .conf files after install.

Do not use default/setup.xml for this. It is deprecated, unsupported on Splunk Cloud Platform and search head clusters, and fails Splunk AppInspect's cloud check (check_setup_xml_in_default) outright. Every app that needs first-run configuration and wants to be Cloud-compatible must use a setup view (Simple XML or React) instead, wired through app.conf's [install] is_configured / [ui] setup_view.

Do not install or reconfigure a production or shared Splunk instance unless the user explicitly confirms that target. Never ask the user for raw Splunk admin credentials — use whatever session/auth Splunk Web already provides via the JS SDK.

Stay scoped to building the setup page itself. Route adjacent requests:

  • General app/add-on packaging, compatibility, upgrade, deprecation, or removal guidance not about the setup page → app-and-add-on-lifecycle-advisor (advisory-only; it will not write or install anything — this skill remains the one that actually builds the setup page).
  • Governance of existing shared knowledge objects (ownership, orphans, ACL review, naming collisions) beyond this app's own default.meta → knowledge-object-governance.
  • HEC or other data-ingestion setup/troubleshooting → hec-setup-and-troubleshooting.
  • Authoring field extractions, CIM mappings, or ad hoc SPL unrelated to the setup page → field-extraction-and-cim-mapping or splunk-search.
  • General Splunk product questions unrelated to setup pages → splunk-product-question-navigator.