Download the tar'ed app from Splunkbase and then go to Apps -> manage apps -> upload from file. Chose whether to overwrite an existing app if you're upgrading  ... View more

Settings -> Add Data -> monitor -> files and directories. You could also add the data as a lookup and do an " | inputlookup asdf | collect sourcetype=stuff index=stuff " but thats kind of a roundabout way of doing it.  ... View more

Monitoring may be done in a properly configured Monitoring Console under the tabs for indexing: distributed enviroment (or something similar, can't remember the exact name) ... View more

You may use a Deployment Server. You can also use the cluster manager to manage the knowledge object bundle, or use SmartStore.  ... View more

There is also the option to use the search -> sidebar -> extract more fields -> and use the automatic field extractor, though this is most often just a jumping-off point for your final field extractions.  ... View more

You can write a search time field extraction under splunk -> settings -> field extractions. A field extraction will apply to a sourcetype and can be either an inline regex based extraction, or use a TRANSFORM from transforms. conf.  You can also extract fields at indextime using transforms.conf on the indexer/HF ... View more

You can manage a lookup table in the settings tab. You can update or write to a lookup either by uploading them or using the "| outputlookup" command. You can also do this on the backend under the directory $SPLUNK_HOME/etc/system/lookups/ , or in $SPLUNK_HOME/etc/<app_name>/lookups/ if the lookup belongs to a specific app. You can also list lookups using the REST api You can access your lookup table at the search bar using "| lookup" or "| inputlookup" Additionally you can set automatic lookups under the fields options. These will apply to a sourcetype kind at search time like how a calculated field or field extraction would work.  ... View more

Indextime extractions can be configured using transforms.conf on the indexer (or indexer cluster).  Searchtime extractions can be set using settings -> field extractions on the Splunk searchead UI. You will need to manage the permissions if you want these extractions to be visible for different user roles, the default would be your user only.  ... View more

The most basic way to create a dashboard would be to run a Splunk Search and then click the "Save As" button, then save as dashboard panel.  ... View more