Apps are a collection of dashboards, saved searches, and configurations for Splunk.
You can certainly fork an app and customize it to your own needs (assuming that the app EULA allows such activity)
All of your apps are located in the $SPLUNK_HOME/etc/apps/
The subfolders in those directories contain the configurations and dashboards that make up an app.
The xml for dashboards can be found in $APP_HOME/default/data/ui/views
The configuration files contained in the app are found in $APP_HOME/default/
If you make changes to configurations it is best to write those changes not to the default folder but to the local folder which should have the same structure within it
If you don't want to mess with the conf files directly, your best bet is to create a copy of the app.
Ex. * cp $SPLUNK_HOME/etc/apps/YOURAPP $SPLUNK_HOME/etc/apps/YOURAPP_copy*
Then go to the copy in the ui and make your changes to it there. If you like your changes and it is stable, then you can use that app instead of the original.
An app is essentially just a container for other objects - reports, dashboards, lookups, field extractions, etc. And if you have the permissions, it should be a simple as creating a new app from the Splunk web interface (to get started at least).
But it helps to have a good understanding of how Splunk works as well. You may be able to copy an app, but that could tricky/frustrating if you don't know how the app works, and can't figure it out. You might also be able to create a custom dashboard in the app itself as well. That way you can take advantage of its field extractions, macros, etc.