Deployment Architecture

What is the best practice for app development and distribution through the deployer?

Path Finder

Does anyone have any links or ideas on best practice for the process of developing an app (group of dashboards) on a local instance of Splunk then distributing that app by using the deployer to a clustered environment?

Example: Developer creates new app with new dashboards on local machine. Now he's ready to migrate it the production environment. The simple step is to copy that app folder over to the deployer and distribute but are there any gotchas we'd need to look out for and how to handle them?

Some examples:
Owner of the app and dashboards doesn't exists in prod environment?
The developer used saved searches or macros on their dashboards?

Please let me know if anyone needs more details


0 Karma

Esteemed Legend

Make sure that all KOs (eventtypes, macros, searches, etc.) are set with app permissions inside of the new app (if any is user/private, it will not be in the app directory). That's pretty much it. If the user does not exist, it will be owned by nobody. No big deal (usually).

0 Karma

Revered Legend

One best practice I would say would be that develop the dashboards and all related objects under an app in the development machine. That way it would be easier to package (using these instructions) and port to other instances or deployer/deployment server.

Additionally, you may want to update .meta files to change owner = <specific user> to owner = nobody before making it live. This way it's not user dependent. Also, note that when any app is deployed though deployer, it's knowledge objects become read-only (user can delete it, but can clone and work on their copies).

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...