Need to understand difference for add on and app

[lmjoin]

Hello team,

From my understanding Add on is used for collecting information on which we install add on .
App is used for visualization of data.
For Unix add on and app :- we need install add on UF for which we need data. We need to install add on or app on indexer ( if we need data or not ? ) . We need visualization of data on Search head , then we need to install app on Search head. Somewhere written to install only add on only for all , any reason for same.
For Mysql add on and app :- on HF we need to install add on and Search head we need to app. But we configure add on on HF and also on Search head , can not understand . Some where written mysql add on install on indexer and search head. any reason for same.

[jtacy]

Your understanding is correct. I would think of an Add-On as a configuration package that end users don't interact with. Add-Ons often define data characteristics to Splunk, such as the timestamp format, linebreaking configuration, and field extractions. Depending on what an Add-On contains, it might require installation on a UF, HF/Indexer, Search Head, or all of the above. An App, on the other hand, will typically only require installation on a Search Head because it only contains objects that an end user is likely to interact with, such as saved searches and views.

As you've noticed, you often need both the App and Add-On installed on your search head for the App to work properly. It's better this way, though; you wouldn't want to install a large, complex App on your indexers just to define a timestamp format for a sourcetype. Add-Ons are typically lightweight and harmless to install so I would go ahead and install them on the components that the documentation suggests. For your two examples:
App for Unix and Linux: http://docs.splunk.com/Documentation/UnixApp/5.2.4/User/DeploytheSplunkAppforUnixandLinuxinadistribu...
Add-On for MySQL: http://docs.splunk.com/Documentation/AddOns/released/MySQL/Install

[ddrillic]

This can help - What are Splunk Apps and Add-Ons ?