Install apps on your Splunk Cloud Platform deployment

Splunk apps are composed of pre-built dashboards, reports, alerts, and workflows, optimized for a particular purpose such as monitoring Web servers or network security. Splunk add-ons are a type of app that provide specific capabilities to other apps, such as getting data in, mapping data, or providing saved searches and macros. For more information on Splunk apps, see Apps and add-ons in the Splunk Enterprise Admin Manual.

You can install most Splunk apps on Splunk Cloud Platform in a self-service manner without assistance from Splunk support. For more information, see About self-service app installation.

To install premium apps, such as Enterprise Security (ES) or IT Service Intelligence (ITSI), you must contact Splunk Support. For information on assisted installation for premium apps, see Splunk premium solutions in the Splunk Cloud Platform Service Description.

You can only install approved apps that meet Splunk Cloud Platform requirements. For information on Splunk app validation, see Validate the quality of Splunk apps using Splunk AppInspect.

About self-service app installation

Splunk Cloud Platform supports self-service installation of both public apps available from Splunkbase and private apps that you create for your deployment. More than 98% of Splunkbase apps are available for self-service app installation. You can install both Splunkbase apps and private apps directly to your Splunk Cloud Platform deployment using the Splunk Web UI.

For instructions on how to install Splunkbase apps using Splunk Web, see Install a public app from Splunkbase.

For instructions on how to install private apps using Splunk Web, see Manage private apps in your Splunk Cloud deployment.

You can also install both Splunkbase apps and private apps programmatically using the Admin Config Service (ACS) API. For more information, see About the Admin Config Service (ACS) API in the Admin Config Service Manual.

Self-service app installation behavior differs depending if your deployment is on Victoria Experience or Classic Experience. For more information, see How self-service app installation works on Victoria Experience.

When to contact Splunk Support

Some app installation and upgrade tasks require help from Splunk Support. Contact Splunk Support and submit a Cloud App Request in the following situations:

• The app is not available for self-service installation.
• The app is not available on Splunkbase.
• The app requires installation on the IDM (Inputs Data Manager).
• The app is a premium solution, such as Enterprise Security (ES) and IT Service Intelligence (ITSI).
• The app requires installation on a Classic Experience premium search head that runs a Splunk Premium App. To determine if your Splunk Cloud Platform deployment is on Victoria Experience or Classic Experience, see Determine your Splunk Cloud Platform Experience.

For more information, see Splunkbase and private apps in the Splunk Cloud Platform Service Description.

Install a public app from Splunkbase

You can install most public apps from Splunkbase directly to your deployment using the Splunk Apps Browser in Splunk Web. You must have the sc_admin role to install apps on Splunk Cloud Platform.

To install a public app on Splunk Cloud Platform:

1. In Splunk Web, click the Apps gear icon.
2. Click Browse more apps.
   The Splunk App Browser opens.
3. Find your app or add-on, then click Install.
4. Enter your Splunk.com login credentials (username and password).
5. Click Agree and Install.
   This confirms that you accept the app license terms and installs the app on your deployment.
6. Consult the specific app's documentation to determine if you must also install the app on forwarders. If yes, you can download the app package from Splunkbase and deploy it manually to your forwarders.

When you install an app with declared dependencies, Splunk Cloud Platform automatically resolves its dependencies through Splunkbase. To learn more about dependencies, see Splunk Packaging Toolkit.

Install restricted Splunkbase apps

App developers can control access to certain apps posted on Splunkbase by setting them to either unrestricted or restricted. If an app is set to restricted, only authorized users can download and install the app. To gain access to a restricted app, you must contact the developer specified on the app download page on Splunkbase.

When you install a restricted Splunkbase app using self-service app installation, you must specify the authorized user's Splunk.com credentials (username and password). You can find the username on your account at https://splunkbase.splunk.com/profile. Make sure to check the specific app installation instructions on Splunkbase for any additional download or installation requirements.

To install a restricted app that is not supported by self-service app installation, you must contact Splunk Support. For apps not authored by Splunk, you must download the app, specifying the authorized user's credentials, then upload it to a support case with your installation request. For apps authored by Splunk, you do not need to upload the app with your support case. To identify the app author, see the specific app download page on Splunkbase.

For more information on restricted Splunkbase apps, see Manage Splunk Cloud Platform and Splunk Enterprise content on Splunkbase in the Splunk Developer Guide.

Manage apps

You can perform the following app management tasks on the App Management page of a Splunk Cloud Platform deployment.

Update an app

You can update an app using either the App Management page or the App Browser page in Splunk Web.

To update an app using the App Management page:

1. In Splunk Web, click Apps > Manage Apps.
2. Find your app, then click Update Available to install the new version.

To update an app using the App Browser page:

1. In Splunk Web, click Apps > Find More Apps.
2. Find your app, then click Update.

After you update an app, you cannot revert to an earlier version of the app. If a new version of your app is available, but the update action is not available in Splunk Web, contact Splunk Support.

You cannot update Splunk Premium apps using the App Management page in Classic Experience. To update a premium app in Classic Experience, contact Splunk Support. You cannot update Enterprise Security (ES) or ITSI premium apps using the App Management page in either Classic or Victoria Experience. To do so, you must contact Splunk support.

Uninstall an app

1. In Splunk Web, click Apps > Manage apps.
2. Click Uninstall. If the Uninstall action is not available for your app, open a support case.

View app install details

To view app installation details, including install date, install location, and install type (self-service or Splunk):

1. In Splunk Web, click Apps > Manage apps.
2. Click the arrow next to the app name to see app installation details.

Configure an app

To configure an app, consult the specific app's documentation for instructions. Configure apps only on the nodes in your deployment where configuration is required.

On Splunk Cloud Platform deployments, inputs must be configured on forwarders under your control.