Install apps on your Splunk Cloud Platform deployment
Splunk apps are composed of pre-built dashboards, reports, alerts, and workflows, optimized for a particular purpose such as monitoring Web servers or network security. Splunk add-ons are a type of app that provide specific capabilities to other apps, such as getting data in, mapping data, or providing saved searches and macros. For more information on Splunk apps, see Apps and add-ons in the Splunk Enterprise Admin Manual.
You can install most Splunk apps on Splunk Cloud Platform in a self-service manner without assistance from Splunk support. For more information, see About self-service app installation.
To install premium apps, such as Enterprise Security (ES) or IT Service Intelligence (ITSI), you must contact Splunk Support. For information on assisted installation for premium apps, see Splunk premium solutions in the Splunk Cloud Platform Service Description.
You can only install approved apps that meet Splunk Cloud Platform requirements. For information on Splunk app validation, see Validate the quality of Splunk apps using Splunk AppInspect.
About self-service app installation
Splunk Cloud Platform supports self-service installation of both public apps on Splunkbase and private apps that you create for your deployment. More than 98% of Splunkbase apps are available for self-service app installation. You can install both Splunkbase apps and private apps directly to your Splunk Cloud Platform deployment using the Splunk Web UI.
For instructions on how to install Splunkbase apps using Splunk Web, see Install a public app from Splunkbase.
For instructions on how to install private apps using Splunk Web, see Manage private apps in your Splunk Cloud deployment.
You can also install private apps programmatically using the Admin Config Service (ACS) API. For more information, see Manage private apps in Splunk Cloud Platform in the Admin Config Service Manual.
Self-service app installation behavior differs depending on if your deployment is on Victoria Experience or Classic Experience. For more information, see How self-service app installation works on Victoria Experience.
When to contact Splunk Support
Some app installation and upgrade tasks require help from Splunk Support. Contact Splunk Support and submit a Cloud App Request in the following situations:
- The app is not available for self-service installation.
- The app is not available on Splunkbase.
- The app requires installation on the IDM (Inputs Data Manager).
- The app is a premium solution, such as Enterprise Security (ES) and IT Service Intelligence (ITSI).
- The app requires installation on a Classic Experience premium search head that runs a Splunk Premium App. To determine if your Splunk Cloud Platform deployment is on Victoria Experience or Classic Experience, see Determine your Splunk Cloud Platform Experience.
For more information, see Splunkbase and private apps in the Splunk Cloud Platform Service Description.
Install a public app from Splunkbase
You can install most public apps from Splunkbase directly to your deployment using the Splunk Apps Browser in Splunk Web. You must have the
sc_admin role to install apps on Splunk Cloud Platform.
To install a public app on Splunk Cloud Platform:
- In Splunk Web, click the Apps gear icon.
- Click Browse more apps.
The Splunk App Browser opens.
- Find your app or add-on, then click Install.
- Enter your Splunk.com login credentials and select the checkbox to accept the app license terms.
- Click Login and Install.
The app is downloaded from Splunkbase and installed on your deployment.
- Consult the app documentation to determine if the app must also be installed on your forwarders. If yes, you can download the app package from Splunkbase and deploy it manually to your forwarders.
When you install an app with declared dependencies, Splunk Cloud Platform automatically resolves its dependencies through Splunkbase. To learn more about dependencies, see Splunk Packaging Toolkit.
You can perform the following app management tasks on the App Management page of a Splunk Cloud Platform deployment.
Update an app
You can update an app using either the App Management page or the App Browser page in Splunk Web.
To update an app using the App Management page:
- In Splunk Web, click Apps > Manage Apps.
- Find your app, then click Update Available to install the new version.
To update an app using the App Browser page:
- In Splunk Web, click Apps > Find More Apps.
- Find your app, then click Update.
After you update an app, you cannot revert to an earlier version of the app. If a new version of your app is available, but the update action is not available in Splunk Web, contact Splunk Support.
If your Splunk Cloud Platform deployment is on the Classic Experience, you cannot update a Splunk Premium App using the App Management page. If you attempt to do so, the updated app automatically reverts to the previous version. To update a Splunk Premium App on Classic Experience, contact Splunk Support. To determine if your deployment has the Classic or Victoria experience see Determine your Splunk Cloud Platform Experience.
Uninstall an app
- In Splunk Web, click Apps > Manage apps.
- Click Uninstall. If the Uninstall action is not available for your app, open a support case.
View app management log
To view a log of app management activities, and the names of users who performed them:
- In Splunk Web, click Apps > Manage apps.
- Click Install Log.
Configure an app
To configure an app, consult the specific app's documentation for instructions. Configure apps only on the nodes in your deployment where configuration is required.
On Splunk Cloud Platform deployments, inputs must be configured on forwarders under your control.
Store expired Splunk Cloud Platform data to a Splunk-managed archive
Manage private apps on your Splunk Cloud Platform deployment
This documentation applies to the following versions of Splunk Cloud Platform™: 8.0.2006, 8.0.2007, 8.1.2009, 8.1.2011, 8.1.2012, 8.1.2101, 8.1.2103, 8.2.2104, 8.2.2105, 8.2.2106, 8.2.2107 (latest FedRAMP release), 8.2.2109, 8.2.2111, 8.2.2112