Getting Data In

ADD-ON uses

dani9
Explorer

why should i install the add-ons in splunk?
collecting data would work the same without it?
Compared to qradar SIEM they are like dsm?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You don't have to install Splunk add-ons. Data onboarding works fine without them. If you like re-inventing the wheel, then skip the add-ons and do your own data ingestion. To save time, however, use the add-ons.

---
If this reply helps you, Karma would be appreciated.
0 Karma

dani9
Explorer

And so spontaneously i question: what's for that? when it is better to install it?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Add-ons are pre-packaged configurations that help onboard data and/or present it (they can do other things as well). Installing an add-on is like installing open-source software on your computer. Sure, you could write your own code to do the same thing, but why do that when someone else has already solved the problem for you?

---
If this reply helps you, Karma would be appreciated.
0 Karma