Splunk Content Packs provide prepackaged content that you can use to quickly set up your Splunk IT Service Intelligence (ITSI) or IT Essentials Work (ITE Work) environment. This content can include configured KPI base searches, service templates, saved glass tables, and other objects for use within ITSI or ITE Work.

The Splunk App for Content Packs lets you to access content packs, preview their contents, and install them in your environment. Download the Splunk App for Content Packs on Splunkbase. The Splunk App for Content Packs is compatible with ITSI and ITE Work versions 4.9.0 and higher. As new content packs become available or existing content packs are updated, you can download the most recent version of the Splunk App for Content Packs to get this new content. When you install an updated version of a content pack, you can see which objects are new to the content pack.

Once you've installed the Splunk App for Content Packs you can go to Configuration > Data Integrations. Depending on your version of ITSI or ITE Work select Add structure to your data or Add content packs to see the available content packs.

Once installed, the objects within a content pack are configurable. If you want to change the frequency of a search frequency, adjust latency, or change calculation methods, you can edit the objects directly.

Most content packs process data collected through the use of Splunk add-ons. Add-ons collect host, network, and other data from computers that you install them on and map that data to a data model. Add-ons power the data underlying the metrics for each content pack. For more information, see About Splunk add-ons in the Splunk Add-ons manual.