Splunk Search

Is there a way to group apps in Splunk deployment?

d3ag0s
Engager

We have started to use the Splunk Deployment within in our infrastructure and I was wondering if there's a way (including an add-on) to group the applications based on specific topics.
For example, we are looking to group the applications based on products and create under each main application their corresponding sub-apps (this should allow us to have a better overview of the entire landscape and keep everything under control).

Current setup:

Options 1:

Product -> where a product has 10 different servers, with 3 different roles (role1,role2 and role3). In this case, we end up with monitors that should only for role1 being setup on role3.

Options 2:

role1, role2, role3 as separate apps - is also an option, but when we end up with over 100 apps things get a little bit hard to manage and we loose overview.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk's deployment server uses a flat app structure. The only grouping of apps is by server class.
Perhaps another tool like Ansible or Puppet will do what you desire.

---
If this reply helps you, Karma would be appreciated.

VatsalJagani
SplunkTrust
SplunkTrust

Are you talking about Splunk App's to group? - Right now there is no way to group the Splunk Apps.
If you want to group the data - Please give more details about events that you are having in your Splunk.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...