Splunk® Supported Add-ons

Splunk Add-ons

Download manual as PDF

Download topic as PDF

Install an add-on in Splunk Cloud

To install add-ons for use with your Splunk Cloud instance, your procedure varies depending on two questions:

  • Is your Splunk Cloud deployment self-service or managed? If you aren't sure, see Types of Splunk Cloud deployment.
  • Does the add-on need to be installed on a forwarder in addition to search heads? Some add-ons require that you install them on a forwarder for data collection. Some add-ons even require specific types of forwarders. Most add-ons also need to be installed on your Splunk Cloud instance to enable their index- and search-time capabilities. Check the documentation for the add-on that you want to use for details.


Determine the answers to those questions, then follow the instructions in the sections below that apply to you.

Self-service Splunk Cloud deployments

You can install add-ons to your self-service instance of Splunk Cloud using the app browser in Splunk Cloud.

  1. From the Splunk Web home screen, click on the gear icon next to Apps in the left navigation bar.
  2. Click Browse more apps.
  3. Find the app or add-on that you want to install, then click Install.
  4. Follow the on-screen prompts to complete your installation.
  5. Consult the add-on documentation to determine if your add-on requires a forwarder for data collection, and if so, what type of forwarders are supported.
  6. If forwarders are required, see Install add-ons to forwarders to get data into Splunk Cloud in this topic.

Managed Splunk Cloud deployments

  1. Consult the add-on documentation to determine if your add-on should be installed on search heads.
  2. If the add-on does need to be installed on search heads, install it on your Splunk Cloud instance. See Install apps in your Splunk Cloud deployment in the Splunk Cloud User Manual.
  3. Turn visibility off on your search heads to prevent data duplication errors that can result from running inputs on your search heads instead of (or in addition to) on your data collection node.
  4. Consult the add-on documentation to determine if your add-on requires a forwarder for data collection, and if so, what type of forwarders are supported.
  5. If the add-on supports universal forwarders but also needs to be installed on indexers in that case, contact Splunk Support to verify that the add-on is installed on your cloud indexers, or use a heavy forwarder instead.
  6. If forwarders are required, see Install add-ons to forwarders to get data into Splunk Cloud in this topic.

Install add-ons to forwarders to get data into Splunk Cloud

If a forwarder is required to get data in, install and configure a forwarder on a server under your control, then install your add-on on that forwarder. Follow the directions for the forwarder type required by the add-on you are installing.

Install an add-on on a universal forwarder

Install and configure a universal forwarder to send data to your Splunk Cloud instance, then install the add-on on that forwarder.

  1. See Forward data in the Splunk Cloud User Manual for complete directions on installing a universal forwarder and configuring the credentials to connect your forwarder to your Splunk Cloud instance.
  2. See Install an add-on in a distributed Splunk Enterprise deployment in this manual and follow the directions to install your add-on on the universal forwarder.

Install an add-on on a heavy forwarder

Install and configure a heavy forwarder to send data to your Splunk Cloud instance, then install the add-on on that forwarder.

  1. Install a full Splunk platform instance on a server under your control.
  2. Configure it as a heavy forwarder. See Set up forwarding in the Splunk Enterprise Forwarding Data manual.
  3. Download and install the forwarder credentials to connect your forwarder to your Splunk Cloud instance.

    Although the credentials package that you download and install is called "Universal Forwarder Credentials", these credentials apply to all types of forwarders. Apply these credentials to forwarders of any type that you need to connect to your Splunk Cloud instance.

    • If your forwarder is installed on a Linux server, see Forward data to Splunk Cloud from Linux in the Splunk Cloud User Manual and scroll down to Step 3: Download and install the universal forwarder credentials.
    • If your forwarder is installed on a Windows server, see Forward data to Splunk Cloud from Microsoft Windows in the Splunk Cloud User Manual and scroll down to Step 3: Download and install the universal forwarder credentials.
    • If your forwarder is installed on a MacOS server, see Forward data to Splunk Cloud from MacOS in the Splunk Cloud User Manual and scroll down to Step 3: Download and install the universal forwarder credentials.
  4. See Install an add-on in a distributed Splunk Enterprise deployment in this manual and follow the directions to install your add-on on the heavy forwarder.
PREVIOUS
Install an add-on in a distributed Splunk Enterprise deployment
  NEXT
Install an add-on in Splunk Light

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters