topic Re: Single deployment app for Prod, Test & DR. in Splunk Search

Single deployment app for Prod, Test & DR.

Harinder_Singh — Tue, 29 Sep 2020 19:17:39 GMT

How we usually do business is; on our deployment server, we will create an app specific to its environment. Which can get repetitive and creates some overhead? Is it possible to consolidate this?

So, for instance, consider the following example:

We use Atlassian suite with a total of 7 products(Bamboo, Jira, etc.), each with Prod, Test, and DR environments. Is it possible to create a single app., for each product with the ability to differentiate between indices? i.e. - jira_test, jira_prod & jira-dr.

Re: Single deployment app for Prod, Test & DR.

bjoernhansen — Sun, 29 Apr 2018 08:13:46 GMT

Am I getting this right?
You don't want to have three copies of your app, with the only difference being which index they should put their index into?

Re: Single deployment app for Prod, Test & DR.

twinspop — Tue, 01 May 2018 15:09:40 GMT

Don't name your indexes differently. It's a terrible idea. When you create dashboards, reports, extractions, etc in lower envs, porting to higher envs could be problematic. Use tags or lookups to differentiate your environments if you really need to. Speaking from experience.

Re: Single deployment app for Prod, Test & DR.

Harinder_Singh — Tue, 01 May 2018 21:44:53 GMT

That is correct. I would really prefer to not have to create 21 apps for all Atlassian applications. From what I have read so far, this would require putting together a bash script placed on the deployment server. So each time the app servers call home, it knows what index to populate.

Thoughts? Am I least going in the right direction?

Re: Single deployment app for Prod, Test & DR.

Harinder_Singh — Tue, 01 May 2018 21:51:30 GMT

Are you saying have one index per application, e.g. - Bamboo, and distinguish between environments based on source type?

Re: Single deployment app for Prod, Test & DR.

somesoni2 — Tue, 01 May 2018 21:55:03 GMT

I don't think so I heard about such script. Do you have the reference link where you've seen it?

So, data for all environments of your Atlassian apps go to same Splunk instance (and that's the reason you've three different indexes)?

Re: Single deployment app for Prod, Test & DR.

Harinder_Singh — Tue, 01 May 2018 22:23:27 GMT

I don't think there's a specific link, it was just me putting 2 and 2 together.
Yes, data goes to a 2 node cluster indexers.

Re: Single deployment app for Prod, Test & DR.

twinspop — Wed, 02 May 2018 01:39:51 GMT

Distinguish by host would be most common. You should keep sourcetype definitions consistent across environments. Again, in my experience.

Re: Single deployment app for Prod, Test & DR.

amitm05 — Wed, 02 May 2018 08:48:41 GMT

I would go with using the same index for your all Atlassian suite apps and env.
However I'd prefer to make use of event types and Tags to differentiate between my environments and apps.

E.g. If Hosts or Source IPs can be used to differentiate the environmental data, you could write an event type to say -
Host = xxx OR Host = yyy OR Host = zzz ...
Also create a Tag for this event type.

Also whatever the differentiator you have for recognizing the app specific event e.g. an App field, create an event type as
App = Jira
Also create a Tag for this event type.

Finally you would be able to see your data by simply querying something as :
Index = Atlassian tag = Production tag = Jira

Let me know if that suits you or anymore details are required.
Thanks.
Please upvote or accept as answer if it serves your purpose 🙂

Re: Single deployment app for Prod, Test & DR.

amitm05 — Wed, 02 May 2018 08:51:56 GMT

And also to mention that this would give you more flexibility on your searches. If in case you want to search over all bamboo data irrespective of your environment, you could simply say:
Index = Atlassian tag = Bamboo

And Yes of course, for once this will require you to do little work to setup all those tags and event types.

Re: Single deployment app for Prod, Test & DR.

Harinder_Singh — Fri, 04 May 2018 03:59:09 GMT

@amitm05 this makes perfect sense and fits our use case. I will start working on implementing and get back to you with questions/updates I have.

Thanks a lot!

Re: Single deployment app for Prod, Test & DR.

amitm05 — Fri, 04 May 2018 11:50:46 GMT

Sure. Do let me know if it works out for you. Cheers !