Splunk Dev

What are the advantages of having a separate Splunk DEV server as opposed to just a separate head?

pettittmj
Engager

While developing apps and testing changes I can see that resource sharing could become a problem hogging the production indexer resources, but are there any benefits to having a separate DEV server or VM? I guess are there any good arguments to justify the expense?

thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Reasons to have a separate DEV environment:
1) Developers can't accidentally break Prod.
2) Dev doesn't steal resources from Prod.
3) Dev can test the latest rev of Splunk without affecting Prod.
4) Simpler management. No complicated permissions on Prod for the Dev team. Just give Dev admin rights on their own box so they can shoot themselves in the foot if they want.

5) No need for Dev to wait for the Prod admin to install updates, etc.

Dev should still have read-only access to Prod, however.

---
If this reply helps you, Karma would be appreciated.

somesoni2
Revered Legend

1) The load of DEV searches will not affect PROD indexers, giving better performance.
1.1) Any really bad search (which people often write during development) or realtime search may kill or make an indexer terribly slow.
2) Prevents accidental delete of PROD data from DEV SH.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...