Hello, I am looking for a solution to manage my splunk objects (searches, event type, macros, lookups, etc). There are two basic needs:
1. Version control for searches (I could probably use SVN)
2. Change impact analysis. e.g. If i change an eventtype, how many of my searches and reports will that effect. I need something like a CMDB for Splunk objects.
Please share if you have already implemented something to address the above.
I created and posted an app recently that might help. I didn't go down the path of impact analysis though.
https://apps.splunk.com/app/2627/
Note that you need to be running 6x as all the base searches are hitting REST endpoints.
I use git and all splunk apps are contained with in a Splunk Project directory. You could write a git hook or jenkins hook to enumerate all repos in that project and search line by line for that eventtype, savedsearch or macro is referenced.