I've almost created a framework to update Splunk configuration items for Search Heads (transforms, props, savedsearches) etc and Create NEW apps via Splunk REST api. This works well in Standalone SH & SH cluster.
Anyone know if there are restrictions/capability restrictions kept in place for Splunk cloud offering?
ie in Cloud offering
- Can I create a new App via Rest api ?
- Can i create/modify configuration items remotely?
You can't create apps using the API and configuration support is limited. See https://docs.splunk.com/Documentation/SplunkCloud/8.2.2105/RESTTUT/RESTandCloud
that's really not good.
>> is restricted from performing the following types of tasks... Installing apps and modifying app configurations
almost cancels the whole point of automation then? How do you guys control the search-time and custom TA configurations in Splunk cloud & Version control them? Manually upload them and give to Splunk support?
There's little need to have Splunk support do it for you. Update your apps off-line making sure you increment the version number in app.conf. Then upload the app(s) to your Splunk Cloud search head. Once they pass vetting you can install them and Splunk Cloud will deploy them to the right instance(s).