ADD-ON uses

[dani9]

why should i install the add-ons in splunk?
collecting data would work the same without it?
Compared to qradar SIEM they are like dsm?

[richgalloway]

You don't have to install Splunk add-ons. Data onboarding works fine without them. If you like re-inventing the wheel, then skip the add-ons and do your own data ingestion. To save time, however, use the add-ons.

[dani9]

And so spontaneously i question: what's for that? when it is better to install it?

[richgalloway]

Add-ons are pre-packaged configurations that help onboard data and/or present it (they can do other things as well). Installing an add-on is like installing open-source software on your computer. Sure, you could write your own code to do the same thing, but why do that when someone else has already solved the problem for you?