All Apps and Add-ons

What are the pros and cons of creating a Splunk app and addon separately?

rshah_splunk
Splunk Employee
Splunk Employee

If developing a new Splunk application, should we prefer creating two separate components, i.e. app and addon or a single bundle? What are the pros and cons? What is the recommended way?

Tags (1)
0 Karma

iandrews_splunk
Splunk Employee
Splunk Employee

Apps are normally for GUI stuff / search heads (dashboards, lookups, etc...)

Add-ons are for knowledge objects, props, transforms, inputs, etc...

If you were to create an add-on that only made a sourcetype CIM compliant, there would be no need for a GUI and, therefore, putting it all in one add-on would be best.

If you wanted to include dashboards, putting the dashboards in an app, and the props/transforms in an add-on, would be best. The admins wouldn't have to install the GUI configs on the indexers, and you could update the two independently.

Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...