Splunk applications and add-ons both use the same extension, but in general, both are quite separate.  Splunk App: An app is an application running on the Splunk Project. Apps are used to analyze and display knowledge around a particular source or set of data. Due to the navigable GUI for user interface, it is considered to be more useful in a wide range. Each Splunk app consists of a collection of Splunk knowledge objects (lookups, tags, saved searches, event types, etc).   An App can be built on a combination of different Add-ons together. This is possible where they can be reused again to build something completely different.  We can also apply user/role-based permissions and access controls to Apps, thus providing for a level of control while deploying and sharing apps across the organization. Example: Splunk Enterprise Security App, etc.  Splunk Add-on: An add-on offers unique features for helping to collect, standardize, and enrich data sources. This includes both free and paid versions. These are the applications that are built on top of the Splunk platform that add features and functionality to other apps.   This could have:  Data source input configurations.  Splunk Business data sorting and transformation settings for structuring the data.  Lookup files for data enrichment.  Supporting knowledge objects.  We could potentially use an Add-on on its own or bundle them together to form the basis of a Splunk App. In this aspect, Splunk add-on can be reused and modularity so that you can more rapidly construct your Apps.