What is the best practice for app development and distribution through the deployer?

[sidekix24]

Does anyone have any links or ideas on best practice for the process of developing an app (group of dashboards) on a local instance of Splunk then distributing that app by using the deployer to a clustered environment?

Example: Developer creates new app with new dashboards on local machine. Now he's ready to migrate it the production environment. The simple step is to copy that app folder over to the deployer and distribute but are there any gotchas we'd need to look out for and how to handle them?

Some examples:
Owner of the app and dashboards doesn't exists in prod environment?
The developer used saved searches or macros on their dashboards?

Please let me know if anyone needs more details

Thanks

[woodcock]

Make sure that all KOs (eventtypes, macros, searches, etc.) are set with app permissions inside of the new app (if any is user/private, it will not be in the app directory). That's pretty much it. If the user does not exist, it will be owned by nobody. No big deal (usually).

[somesoni2]

One best practice I would say would be that develop the dashboards and all related objects under an app in the development machine. That way it would be easier to package (using these instructions) and port to other instances or deployer/deployment server.

Additionally, you may want to update .meta files to change owner = <specific user> to owner = nobody before making it live. This way it's not user dependent. Also, note that when any app is deployed though deployer, it's knowledge objects become read-only (user can delete it, but can clone and work on their copies).