In Splunk Cloud there appears to be a disconnect between building apps (using the UI) and deploying them into production (in .conf files). Currently we build apps in the UI and try to retain copies of the artefacts in Github as we go along. Eventually, when we are happy that the app works in the GUI and we want to productionise, we ask Splunk to send us a copy of the .conf files that have been created in /default - we create an app with the files in /local, package them, delete the app from the UI, drop a version into Git, and download to deploy.
We need to improve our 'developer journey' for building Splunk apps for Splunk Cloud - we are moving to a model where user departments take responsibility for developing their own use cases (queries, alerts, dashboards) in future, whereas we currently build and manage everything for them centrally. So we need to get some robust processes in place for standards, code management, build, release, change management, testing, documentation, etc. It seems to me that the Splunk Cloud app management leaves all of this management to us, and I would like to understand how others have done it well. Does anyone have a view on best practices?
