All Apps and Add-ons

Admin BEWARE! (index=* w/ accelerated datamodels)

jtrujillo
Path Finder

This app should be index=f5-* by default rather than index=*. If the default on the iApp side is f5-* .... just use that please.

This is a VERY DANGEROUS app to put into a production environment.

Please be aware that this could negatively impact your environment if installed in a vanilla state.

Owner, I can/will/want to take this down if the app is reconfigured to have a default of index=f5-*

Also, please disable the DM acceleration by default.

awillcox
Explorer

I wish I would have seen this earlier. We've been having performance issues with our system for months and they finally alleviated themselves once we disabled the this app from Splunk among other things. Considering the poor results I'm getting from trying to rely on Syslog, I may end up re-implementing this iApp.

0 Karma

gjanders
SplunkTrust
SplunkTrust

Alerts for Splunk Admins has some alerts around this but not sure if I covered data models or not 🙂
Beware of all time data models as well

0 Karma

gjanders
SplunkTrust
SplunkTrust

I believe this is part of a larger problem that Splunk does not publish a best practice list for the apps.

The app inspect program is the closest that is available currently and it does do various checks for "best practice", this app does not have the app inspect badge

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...