Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- Need to understand difference for add on and app
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Need to understand difference for add on and app
Hello team,
From my understanding Add on is used for collecting information on which we install add on .
App is used for visualization of data.
For Unix add on and app :- we need install add on UF for which we need data. We need to install add on or app on indexer ( if we need data or not ? ) . We need visualization of data on Search head , then we need to install app on Search head. Somewhere written to install only add on only for all , any reason for same.
For Mysql add on and app :- on HF we need to install add on and Search head we need to app. But we configure add on on HF and also on Search head , can not understand . Some where written mysql add on install on indexer and search head. any reason for same.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Your understanding is correct. I would think of an Add-On as a configuration package that end users don't interact with. Add-Ons often define data characteristics to Splunk, such as the timestamp format, linebreaking configuration, and field extractions. Depending on what an Add-On contains, it might require installation on a UF, HF/Indexer, Search Head, or all of the above. An App, on the other hand, will typically only require installation on a Search Head because it only contains objects that an end user is likely to interact with, such as saved searches and views.
As you've noticed, you often need both the App and Add-On installed on your search head for the App to work properly. It's better this way, though; you wouldn't want to install a large, complex App on your indexers just to define a timestamp format for a sourcetype. Add-Ons are typically lightweight and harmless to install so I would go ahead and install them on the components that the documentation suggests. For your two examples:
App for Unix and Linux: http://docs.splunk.com/Documentation/UnixApp/5.2.4/User/DeploytheSplunkAppforUnixandLinuxinadistribu...
Add-On for MySQL: http://docs.splunk.com/Documentation/AddOns/released/MySQL/Install
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This can help - What are Splunk Apps and Add-Ons ?
Thanks for the Memories! Splunk University, .conf25, and our Community
Data Persistence in the OpenTelemetry Collector
Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever
