What is the difference between Splunk App for AWS and Splunk Add-On for Amazon Web Services?

[akarivaratharaj]

Hi,

I am very new to this topic. I want to work on collecting the AWS data into Splunk for our projects.

Could you anyone please let me know the difference between Splunk App for AWS and Splunk Add-On for Amazon Web Services. So that we can use the app in our project according to their features.

[rpille_splunk]

Others here have commented and answered about the difference between apps and add-ons in general, which is useful. While all generalizations will inevitably find some exceptions, it is generally true that apps have the snazzy dashboards that you use to solve your business use cases while add-ons do more "behind-the-scenes" work, such as data collection and knowledge management. I would add also that apps often rely on add-ons to work, but never the other way around. You can think of add-ons as building blocks of functionality that allow you to do lots of other things.

The main source of truth for the particular app and add-on you are talking about is the documentation.

Docs for the add-on: http://docs.splunk.com/Documentation/AddOns/released/AWS/Description
Docs for the app: http://docs.splunk.com/Documentation/AWS/5.1.0/Installation/Abouttheapp

[woodcock]

Very generally, an App has visualizations (i.e. dashboards) and goes on Search Heads where as an Add-On does NOT have visualizations ( is_visible = false ) and either facilitates getting data into Splunk or massages the data in some way (e.g. field extractions) to prepare it for general use. Within the Add-On category are IA ( Input Add-On which has modular inputs ), and more; see here:
http://docs.splunk.com/Documentation/Splunk/latest/InheritedDeployment/Apps

[rpille_splunk]

In this particular case, though, the Splunk Add-on for Amazon Web Services does have configuration screens, so it is is_visible=true. The visibility distinction is no longer a useful one when trying to distinguish between apps and add-ons, because many add-ons have their own views, mostly for configuration or health checks.

[niketn]

@akarivaratharaj, you would need to understand the difference between Add-on and Apps. Please refer to similar question on ServiceNow App and Addon.

https://answers.splunk.com/answers/557104/splunk-add-on-for-servicenow-vs-splunk-add-on-for.html