All,
I have been asked to make Splunk more self service. The first ask from management is that our developers be able to code and release their own TA's for their own apps in our development data center without the Splunk admin (we'll still promote said apps to prod).
Just so we're clear I am hopelessly out numbers with 400+ splunk users, dev, prod and ES instances and I am the only Splunk guy.
I stood up a developer instance of Splunk they can copy their logs to, and install some App building TAs.
I played with Jenkins/GIT and that worked, its just a little slow and a lot to teach and manage. I wrote a job that allows users to upload SPL zipped apps to the deployment server via the the app manager then the job moves it to deployment-apps, and that is somewhat functional.
Have other run into this? Can I hear you best practices? Lessons learned?
