Modify a Custom App/Add-ons

Available Languages

Updated:September 28, 2026
Document ID:SPLK044677

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud

Description

Request
When you want to modify a custom app/add-on, this is the basic high-level process.

You can also search the Knowledge Base for "Create a Custom App" for more details about creating a custom app/add-on.

Resolution

Solution


Splunk does not modify custom Apps/add-ons. It should be done by the end user via a new version of the app. 

These are the steps to modify any setting within a custom app or add on:

1. Add the files you want to a new version of the custom App/Add-on.
2. Make sure the version is implemented in default/app.conf. In other words, "version = 1.x" is incremented (1.1 or 1.0.1, etc.)
3. TEST the new version in your environment
4. Either submit the new version via the Splunk UI (Self Service portal) or Create an app install ticket.
5. Attach the updated app/add-on (in .tgz, .tar, or .spl format).
6. It will be submitted for vetting.
7. If the app/addon passes vetting, it would get installed via self service portal or by support depending on how it was requested 
8. If you are asking for the app to be installed, provide the location/s where the app should be installed 
9. If you are asking for the app to be installed, provide a maintenance window as it will require restarting the Search Head, or a bundle push (and possibly a rolling-restart) if it is going on indexers. Done automatically with self service portal 

Maintenance Window Requirements (Only applicable when the request is sent to Splunk's Support team)


Please provide several dates, times and the time zone (ideally 4hrs long, and at least 48 hours lead time) for a change window.

Splunk available change windows are between Monday 0100 UTC to Saturday 0100 UTC.
(This is any time between Sun 5pm to Fri 5pm PST)

It is recommended to provide several maintenance windows to have more flexibility on Splunk's end to schedule the change.

An internal process would be started on the Splunk side to get the change done based on the maintenance windows received. 

Revision History

Revision Publish Date Comments
1.0
28-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products