Collect from any Search Head?

[splk]

Hello Community,

we are in a setup process of a local development environmet (with pushing to a git server and so on).

One question arise:
If I setup my local Splunk installation as a Search Head, I can utitilize the production data for development.
But, how to prevent running (and executing) some crucial commands like collect, and creating form my "DEV-SearchHead" data to the production index.

Any hint is welcome.

Kind regards

[chrisyounger]

You should be very careful if connecting a non-prod SH to production indexer/s. Not only can commands like |delete and |collect cause problems but its also very easy to accidentally add apps to your dev environment that create a ton of load on your prod indexers. I have seen time and time again customers adding apps with Report Accelerations and Data Model Accelerations to Dev which cause a huge amount of load on the production environment.

If you are careful you can do what you want. However its typically safest to keep the environments totally seperate and just manually export data from prod to dev when you need to do things.

All the best

[splk]

Thank you for your quick response.
Yes I think we have to separate it, but from a Dev perspective it is so much easyier to have access to the data.

A "read-only" Searh Head Mode would be perfect.

[chrisyounger]

Unfortunately there is no way to do this. It seems like it would be a good feature though.

The best you can do is to not use admin account and take away your various capabilities