Single deployment app for Prod, Test & DR.

[Harinder_Singh]

How we usually do business is; on our deployment server, we will create an app specific to its environment. Which can get repetitive and creates some overhead? Is it possible to consolidate this?

So, for instance, consider the following example:

We use Atlassian suite with a total of 7 products(Bamboo, Jira, etc.), each with Prod, Test, and DR environments. Is it possible to create a single app., for each product with the ability to differentiate between indices? i.e. - jira_test, jira_prod & jira-dr.

[amitm05 · Accepted solution]

I would go with using the same index for your all Atlassian suite apps and env.
However I'd prefer to make use of event types and Tags to differentiate between my environments and apps.

E.g. If Hosts or Source IPs can be used to differentiate the environmental data, you could write an event type to say -
Host = xxx OR Host = yyy OR Host = zzz ...
Also create a Tag for this event type.

Also whatever the differentiator you have for recognizing the app specific event e.g. an App field, create an event type as
App = Jira
Also create a Tag for this event type.

Finally you would be able to see your data by simply querying something as :
Index = Atlassian tag = Production tag = Jira

Let me know if that suits you or anymore details are required.
Thanks.
Please upvote or accept as answer if it serves your purpose 🙂

[Harinder_Singh]

@amitm05 this makes perfect sense and fits our use case. I will start working on implementing and get back to you with questions/updates I have.

Thanks a lot!

[amitm05]

Sure. Do let me know if it works out for you. Cheers !

[amitm05]

And also to mention that this would give you more flexibility on your searches. If in case you want to search over all bamboo data irrespective of your environment, you could simply say:
Index = Atlassian tag = Bamboo

And Yes of course, for once this will require you to do little work to setup all those tags and event types.

[twinspop]

Don't name your indexes differently. It's a terrible idea. When you create dashboards, reports, extractions, etc in lower envs, porting to higher envs could be problematic. Use tags or lookups to differentiate your environments if you really need to. Speaking from experience.

[Harinder_Singh]

Are you saying have one index per application, e.g. - Bamboo, and distinguish between environments based on source type?

[twinspop]

Distinguish by host would be most common. You should keep sourcetype definitions consistent across environments. Again, in my experience.

[bjoernhansen]

Am I getting this right?
You don't want to have three copies of your app, with the only difference being which index they should put their index into?

[Harinder_Singh]

That is correct. I would really prefer to not have to create 21 apps for all Atlassian applications. From what I have read so far, this would require putting together a bash script placed on the deployment server. So each time the app servers call home, it knows what index to populate.

Thoughts? Am I least going in the right direction?

[somesoni2]

I don't think so I heard about such script. Do you have the reference link where you've seen it?

So, data for all environments of your Atlassian apps go to same Splunk instance (and that's the reason you've three different indexes)?

[Harinder_Singh]

I don't think there's a specific link, it was just me putting 2 and 2 together.
Yes, data goes to a 2 node cluster indexers.