Splunk by itself is great for getting data into one place for viewing. Splunk will try its best to extract fields it sees but doesn't always get everything. Also, dashboards that provide value related to a particular data source (e.g. web proxy logs) don't exist by default in Splunk. Applications provide the following functionality:
Knowledge objects to parse the data (field extractions, eventtypes that classify data into types (e.g. authentication events))
Dashboards to view the data in a meaningful way
Some applications provide modular inputs to pull data from a particular source into Splunk
To do this yourself you will find the task to be daunting. Applications make that easier. If you download and install an app in your Splunk environment you may find that there is some tweaking that will need to be done (e.g. specifying what index your data resides). Splunk applications allow the end user to customize an app to fit in their environment. Apps aren't compiled. You have access to all of the Python scripts (if there are any) and configuration files.
Bottom line applications (if written correctly) can make your life simpler.
... View more
