As mentioned earlier, organizations will develop familiarities specific to their needs as they use Splunk to gain information from data. In time, as the organization matures, most of them will create Splunk knowledge objects (also explained earlier in this book).

These familiarities and knowledge objects can be used to enhance or extend Splunk in various ways, including the development of custom apps and add-ons. An app contains a user interface (UI) that you can customize. Add-ons are smaller, reusable components that do not contain a navigable UI. The apps that you develop can be installed and used throughout your internal environment or can be shared globally by uploading them to http://apps.splunk.com/.

In addition to extending the capabilities of basic Splunk, apps can be used to create separate Splunk instances into functional environments. As Splunk can be configured with any number of apps, multiple organizational groups can use Splunk without an overlap...