Installation

Collect from any Search Head?

splk
Communicator

Hello Community,

we are in a setup process of a local development environmet (with pushing to a git server and so on).

One question arise:
If I setup my local Splunk installation as a Search Head, I can utitilize the production data for development.
But, how to prevent running (and executing) some crucial commands like collect, and creating form my "DEV-SearchHead" data to the production index.

Any hint is welcome.

Kind regards

Tags (1)
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

You should be very careful if connecting a non-prod SH to production indexer/s. Not only can commands like |delete and |collect cause problems but its also very easy to accidentally add apps to your dev environment that create a ton of load on your prod indexers. I have seen time and time again customers adding apps with Report Accelerations and Data Model Accelerations to Dev which cause a huge amount of load on the production environment.

If you are careful you can do what you want. However its typically safest to keep the environments totally seperate and just manually export data from prod to dev when you need to do things.

All the best

0 Karma

splk
Communicator

Thank you for your quick response.
Yes I think we have to separate it, but from a Dev perspective it is so much easyier to have access to the data.

A "read-only" Searh Head Mode would be perfect.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Unfortunately there is no way to do this. It seems like it would be a good feature though.

The best you can do is to not use admin account and take away your various capabilities

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...