Install apps on your Splunk Cloud Platform deployment
Splunk apps are composed of pre-built dashboards, reports, alerts, and workflows, optimized for a particular purpose such as monitoring Web servers or network security. Splunk add-ons are a type of app that provide specific capabilities to other apps, such as getting data in, mapping data, or providing saved searches and macros. For more information on Splunk apps, see Apps and add-ons in the Splunk Enterprise Admin Manual.
Only approved apps can be installed on a Splunk Cloud Platform deployment. Approved apps have been validated by Splunk to ensure they comply with the security requirements of Splunk Cloud Platform.
About self-service app installation
Splunk Cloud Platform supports self-service installation of both public apps available on Splunkbase and private apps that you create for your deployment. You can install apps directly to your Splunk Cloud Platform deployment using the Splunk Web UI.
For instructions on how to install public apps using Splunk Web, see Install an app on this page.
For instructions on how to install private apps using Splunk Web, see Manage private apps in your Splunk Cloud deployment.
Splunk Cloud Administrators can also install private apps programmatically using the Admin Config Service (ACS) API. For more information, see Manage private apps in Splunk Cloud Platform in the Admin Config Service Manual.
Before you install apps
Some app installation and upgrade tasks require help from Splunk Support. Contact Splunk Support and submit a Cloud App Request in the following situations:
- The app is not available for self-service installation.
- The app is not available on Splunkbase.
- The app requires installation on the IDM (Inputs Data Manager).
- The app is on a Classic Experience search head that runs a Splunk Premium App. To determine if your Splunk Cloud Platform deployment is on Classic Experience or Victoria Experience, see Determine your Splunk Cloud Platform Experience.
For help installing Splunk premium apps, such as Splunk Enterprise Security and Splunk IT Service Intelligence, contact Splunk Support.
For more information, see Splunkbase and private apps in the Splunk Cloud Platform Service Description.
Install an app
You can install most public apps from Splunkbase directly to your deployment using the Splunk Apps Browser in Splunk Web. You must have the
sc_admin role to install apps on Splunk Cloud Platform.
To install a public app on Splunk Cloud Platform:
- In Splunk Web, click the Apps gear icon.
- Click Browse more apps.
The Splunk App Browser opens.
- Find your app or add-on, then click Install.
- Enter your Splunk.com login credentials and select the checkbox to accept the app license terms.
- Click Login and Install.
The app is downloaded from Splunkbase and installed on your deployment.
- Consult the app documentation to determine if the app must also be installed on your forwarders. If yes, you can download the app package from Splunkbase and deploy it manually to your forwarders.
When you install an app with declared dependencies, Splunk Cloud Platform automatically resolves its dependencies through Splunkbase. To learn more about dependencies, see Splunk Packaging Toolkit.
Splunk Cloud Platform administrators can perform the following app management tasks on the App Management page of a Splunk Cloud Platform deployment.
Update an app
You can update an app using either the App Management page or the App Browser page in Splunk Web.
To update an app using the App Management page:
- In Splunk Web, click Apps > Manage Apps.
- Find your app, then click Update Available to install the new version.
To update an app using the App Browser page:
- In Splunk Web, click Apps > Find More Apps.
- Find your app, then click Update.
After you update an app, you cannot revert to an earlier version of the app. If a new version of your app is available, but the update action is not available in Splunk Web, contact Splunk Support.
If your Splunk Cloud Platform deployment is on the Classic Experience, you cannot update a Splunk Premium App using the App Management page. If you attempt to do so, the updated app automatically reverts to the previous version. To update a Splunk Premium App on Classic Experience, contact Splunk Support. To determine if your deployment has the Classic or Victoria experience see Determine your Splunk Cloud Platform Experience.
Uninstall an app
- In Splunk Web, click Apps > Manage apps.
- Click Uninstall. If the Uninstall action is not available for your app, open a support case.
View app management log
To view a log of app management activities, and the names of users who performed them:
- In Splunk Web, click Apps > Manage apps.
- Click Install Log.
Configure an app
To configure an app, consult the specific app's documentation for instructions. Configure apps only on the nodes in your deployment where configuration is required.
On Splunk Cloud Platform deployments, inputs must be configured on forwarders under your control.
For additional app management capabilities, open a support case
Store expired Splunk Cloud Platform data to a Splunk-managed archive
Manage private apps on your Splunk Cloud Platform deployment
This documentation applies to the following versions of Splunk Cloud Platform™: 8.0.2006, 8.0.2007, 8.1.2009, 8.1.2011, 8.1.2012, 8.1.2101, 8.1.2103, 8.2.2104, 8.2.2105 (latest FedRAMP release), 8.2.2106, 8.2.2107, 8.2.2109