Deployment Architecture

What is the best practice for app development and distribution through the deployer?

sidekix24
Path Finder

Does anyone have any links or ideas on best practice for the process of developing an app (group of dashboards) on a local instance of Splunk then distributing that app by using the deployer to a clustered environment?

Example: Developer creates new app with new dashboards on local machine. Now he's ready to migrate it the production environment. The simple step is to copy that app folder over to the deployer and distribute but are there any gotchas we'd need to look out for and how to handle them?

Some examples:
Owner of the app and dashboards doesn't exists in prod environment?
The developer used saved searches or macros on their dashboards?

Please let me know if anyone needs more details

Thanks

0 Karma

woodcock
Esteemed Legend

Make sure that all KOs (eventtypes, macros, searches, etc.) are set with app permissions inside of the new app (if any is user/private, it will not be in the app directory). That's pretty much it. If the user does not exist, it will be owned by nobody. No big deal (usually).

0 Karma

somesoni2
SplunkTrust
SplunkTrust

One best practice I would say would be that develop the dashboards and all related objects under an app in the development machine. That way it would be easier to package (using these instructions) and port to other instances or deployer/deployment server.

Additionally, you may want to update .meta files to change owner = <specific user> to owner = nobody before making it live. This way it's not user dependent. Also, note that when any app is deployed though deployer, it's knowledge objects become read-only (user can delete it, but can clone and work on their copies).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...