Splunk® Enterprise

Admin Manual

Splunk Enterprise version 7.2 is no longer supported as of April 30, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Apps and add-ons

Apps and add-ons allow you to extend the functionality of the Splunk platform. There are no definitive criteria that universally distinguish an app from an add-on. Both are packaged sets of configuration that you install on your instance of the Splunk platform, and both make it easier to integrate with, or ingest data from, other technologies or vendors.

  • Apps generally offer extensive user interfaces that enable you to work with your data, and they often make use of one or more add-ons to ingest different types of data.
  • Add-ons generally enable the Splunk platform or a Splunk app to ingest or map a particular type of data.

To an admin user, the difference matters very little as both apps and add-ons function as tools to help you get data into the Splunk platform and efficiently use it.

To an app developer, the difference matters more. See dev.splunk.com for guidance on developing apps.

App

An app is an application that runs on the Splunk platform. By default, the Splunk platform includes one basic app that enables you to work with your data: the Search and Reporting app. To address additional use cases, you can install other apps on your instance of Splunk Enterprise. Some apps are free and others are paid. Examples include Splunk App for Microsoft Exchange, Splunk Enterprise Security, and Splunk DB Connect. An app might make use of one or more add-ons to facilitate how it collects or maps particular types of data.

Add-on

An add-on runs on the Splunk platform to provide specific capabilities to apps, such as getting data in, mapping data, or providing saved searches and macros. Examples include Splunk Add-on for Checkpoint OPSEC LEA, Splunk Add-on for Box, and Splunk Add-on for McAfee.


App and add-on support

Anyone can develop an app or add-on for Splunk software. Splunk and members of our community create apps and add-ons and share them with other users of Splunk software via Splunkbase, the online app marketplace. Splunk does not support all apps and add-ons on Splunkbase. Labels in Splunkbase indicate who supports each app or add-on.

  • The Splunk Support team accepts cases and responds to issues only for the apps and add-ons which display a Splunk Supported label on Splunkbase.
  • Some developers support their own apps and add-ons. These apps and add-ons display a Developer Supported label on Splunkbase.
  • The Splunk developer community supports apps and add-ons which display a Community Supported label on Splunkbase.
Last modified on 29 April, 2020
KV store troubleshooting tools   Search and Reporting app

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters