Overview of the Splunk Add-on Builder

The Splunk Add-on Builder is a Splunk app that helps you build and validate technology add-ons for your Splunk Enterprise deployment.

What is an add-on?

An add-on is a reusable Splunk component, much like an app, but does not contain a navigable view. Add-ons can include any combination of custom configurations, scripts, data inputs, custom reports or views, and themes that can change the look and feel of Splunk Enterprise. A single add-on can be used in multiple apps, suites, or solutions.

Technology add-ons are specialized add-ons that help to collect, transform, and normalize data feeds from specific sources in your Splunk environment. Add-ons can include:

• A feed to help gather data from a source
• Field extractions
• A map that normalizes the data to the Common Information Model

For more about apps and add-ons, see Apps and add-ons: an introduction in the Splunk Enterprise Developing Views and Apps for Splunk Web manual, and Apps and add-ons in the Splunk Enterprise Admin Manual.

Why create a technology add-on?

Technology add-ons provide knowledge mapping, making it easier to do data transformations on unstructured data and extract value from raw event data. Many add-ons help collect the data from data sources, reducing the time spent to reach value. And, add-ons are particularly useful when you need to get data into the Splunk platform and the data is not in one of the native input formats.

Why use the Splunk Add-on Builder?

The Splunk Add-on Builder is intended to guide you through the process of creating a technology add-on without you having to know everything there is to know about the Splunk platform.

The goals of the Splunk Add-on Builder are to:

• Guide you through all of the necessary steps of creating an add-on
• Reduce development and testing time
• Follow best practices and naming conventions
• Maintain CIM compliance
• Maintain quality of add-ons
• Validate and test the add-on, helping you to identify any limitations such as compatibilities and dependencies
• Maintain a consistent look and feel while still making it easy for you to add branding
• Package the add-on and helps you get ready to submit it for certification

Who is the Splunk Add-on Builder for?

The Splunk Add-on Builder is for:

• Splunk admins who would like to onboard additional data into Splunk.
• Developers who are looking for a tool to help them build and validate a Splunk add-on.