Splunk objects configuration management/CMDB

[rmurthy]

Hello, I am looking for a solution to manage my splunk objects (searches, event type, macros, lookups, etc). There are two basic needs:
1. Version control for searches (I could probably use SVN)
2. Change impact analysis. e.g. If i change an eventtype, how many of my searches and reports will that effect. I need something like a CMDB for Splunk objects.

Please share if you have already implemented something to address the above.

[Runals]

I created and posted an app recently that might help. I didn't go down the path of impact analysis though.

https://apps.splunk.com/app/2627/

Note that you need to be running 6x as all the base searches are hitting REST endpoints.

[bmacias84]

I use git and all splunk apps are contained with in a Splunk Project directory. You could write a git hook or jenkins hook to enumerate all repos in that project and search line by line for that eventtype, savedsearch or macro is referenced.