Working on a large Splunk Cloud engagement (Classic Experience, ES on the premium search head) and want a sanity check on a design decision. Normally I'd go the Add-on Builder route for CIM tag/eventtype work. Problem is Classic doesn't support self-service app install on premium search heads, so every TA push to the ES SH means a Support ticket as I understand it. This would slow us down and add a lot of overhead. Right now we're building tags/eventtypes directly in the ES app via Settings (globally shared). Curious how others have handled this: Anyone doing continuous TA pushes via Support tickets and it's not as painful as it sounds? Has an ES upgrade ever clobbered custom local tags/eventtypes living in the ES app, or is that risk overstated? Better middle ground I'm missing? Thanks! ... View more