topic Re: Splunk objects configuration management/CMDB in Splunk Search

Splunk objects configuration management/CMDB

rmurthy — Fri, 17 Aug 2012 10:35:27 GMT

Hello, I am looking for a solution to manage my splunk objects (searches, event type, macros, lookups, etc). There are two basic needs:
1. Version control for searches (I could probably use SVN)
2. Change impact analysis. e.g. If i change an eventtype, how many of my searches and reports will that effect. I need something like a CMDB for Splunk objects.

Please share if you have already implemented something to address the above.

Re: Splunk objects configuration management/CMDB

bmacias84 — Tue, 12 Aug 2014 22:11:36 GMT

I use git and all splunk apps are contained with in a Splunk Project directory. You could write a git hook or jenkins hook to enumerate all repos in that project and search line by line for that eventtype, savedsearch or macro is referenced.

Re: Splunk objects configuration management/CMDB

Runals — Tue, 10 Feb 2015 21:45:00 GMT

I created and posted an app recently that might help. I didn't go down the path of impact analysis though.

https://apps.splunk.com/app/2627/

Note that you need to be running 6x as all the base searches are hitting REST endpoints.