Splunk® Supported Add-ons

Splunk Add-ons

Add-ons and CIM

Splunk add-ons are most commonly used to bring a new data source into the Splunk platform. Most add-on developers design their add-ons to be used with the Splunk Common Information Model (CIM) in order to work with the larger Splunk ecosystem. Splunk-developed add-ons provide the field extractions, lookups, and event types needed to map data to the CIM, allowing customers to easily use the new data source in data models, pivots, and CIM-based apps.

The Splunk Common Information Model add-on is not required to use add-on features such as data collection, prebuilt panels, or custom commands. You can use individual add-ons on their own, without installing the CIM add-on, if you do not want to map their data to the CIM.

To take advantage of the CIM mappings provided in an add-on, install the Splunk Common Information Model add-on to your search heads. The Splunk Common Information Model add-on is packaged with CIM-based apps such as Splunk Enterprise Security and the Splunk App for PCI Compliance. If you are using an add-on in conjunction with one of these apps, you do not need to install the Splunk Common Information Model add-on separately. However, the Splunk Common Information Model add-on is not packaged with all apps that are designed to use the CIM. In order to use data from an add-on with an app that relies on the CIM, you need to install the Splunk Common Information Model add-on.

A full list of apps that work with the Splunk Common Information Model is available on Splunkbase.

Last modified on 21 July, 2021
About Splunk add-ons   Source types for add-ons

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters