rss.livelink.thread@place:occasion

Awesome Admins: Managing Your Cloud Deployment - Wed 6/14/23

adepp — Mon, 26 Jun 2023 21:41:55 GMT

This thread is for the Office Hours session Awesome Admins: Managing Your Splunk Cloud Deployment on Wed, June 14, 2023 at 1pm PT / 4pm ET.

Register Here to level up your Cloud Admin Chops! Join our new bi-weekly Office Hours zoom series where technical Splunk experts answer questions and provide how-to guidance on a different topic every month. This session is dedicated to Splunk Cloud Admins and will cover any topics or questions related to:

Optimizing your Splunk Cloud deployment
Streamlining common admin tasks with ACS
Monitoring your system health with Cloud Monitoring Console
Managing configurations

Please submit your questions below as comments in advance. You can also head to the #office-hours user Slack channel to ask questions (request access here).

Pre-submitted questions will be prioritized. After that, we will go in order of the questions posted below, then will open the floor up to live Q&A with meeting participants. If there’s a quick answer available, we’ll post as a direct reply.

Look forward to connecting!

Re: Awesome Admins: Managing Your Cloud Deployment - Wed 6/14/23

adepp — Thu, 01 Jun 2023 01:11:59 GMT

Hi Everyone!

Make sure you drop your questions/comments here for any topics you'd like to see discussed in the Community Office Hours session (you can also head to the #office-hours user Slack channel to ask questions and join the discussion - request access here).

Re: Awesome Admins: Managing Your Cloud Deployment - Wed 6/14/23

SamC — Tue, 06 Jun 2023 13:09:58 GMT

Hi,

With the upcoming Splunk Cloud Developer edition, can you share any upcoming features upon release which will help with testing any admin changes or custom apps/add-ons before making the changes in a Splunk Cloud production environment? Are you able to share any information, such as the amount of test data we'd be allowed to ingest?

Many thanks,

Sam Clark

Re: Awesome Admins: Managing Your Cloud Deployment - Wed 6/14/23

adepp — Thu, 22 Jun 2023 22:36:50 GMT

Hi Sam! Here's the Expert Solution from the session:

Splunk Cloud Developer Edition is still in Limited Availability Release - at this time we are not adding new customers.
Splunk is working to gain further resources internally to develop SCDE further
General Availability is not yet set
Remember features and functionality of SCDE is subject to change before General Availability.

Re: Awesome Admins: Managing Your Cloud Deployment - Wed 6/14/23

adepp — Mon, 26 Jun 2023 21:40:40 GMT

Here are some of the questions from the session:

Q1: I recently enabled and configured ACS, but I’m not sure the best way to get started from here. What are the different ACS tools/features I should look into that will give me the highest ROI on the time it’ll take me to configure?

A: If you’re familiar with CURL command, you can use ACS directly

ACS Manual Page: https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSIntro with CURL example
Example of integrating ACS with your pipeline https://github.com/splunk/acs-privateapps-demo

If your team is using Terraform - ACS also supports terraform (Indexes, *HEC Tokens, *IP Allowlist) https://registry.terraform.io/providers/splunk/scp/latest
If you want something more interactive or easy to use, ACS supports the ACS CLI: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/Config/ACSCLI

The CLI supports bulk operations for HEC Tokens, Indexes and Apps, which allows you to create or update multiple resources in just one line.

Q2: So if the graph is showing as red during a specific time frame, will we know exactly what is being impacted if the performance is degraded? For example, would it be ingestion? Would it be search runtime? Would it be any specific things? Or is it just performance in general? It's kind of a um difficult thing to interpret.

A: Check out the “Monitoring system health” section of this Lantern article: Managing your Splunk Cloud Platform deployment

Q3: Are there any best practices for managing large numbers of users in Splunk Cloud? E.g., if I want to grant varying access permissions to specific indexes, apps, and data sources?

A: Check out the Splunk Success Framework introduction on Lantern to get started with best practices
Tips and Tricks to managing large number of users: https://www.conducivesi.com/splunk-blog/3-tips-to-maintaining-splunk-over-the-long-haul-users-roles
Use the Admin Config Console to grant access to specific indexes.