Splunk Dev

What are the advantages of having a separate Splunk DEV server as opposed to just a separate head?

pettittmj
Engager

While developing apps and testing changes I can see that resource sharing could become a problem hogging the production indexer resources, but are there any benefits to having a separate DEV server or VM? I guess are there any good arguments to justify the expense?

thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Reasons to have a separate DEV environment:
1) Developers can't accidentally break Prod.
2) Dev doesn't steal resources from Prod.
3) Dev can test the latest rev of Splunk without affecting Prod.
4) Simpler management. No complicated permissions on Prod for the Dev team. Just give Dev admin rights on their own box so they can shoot themselves in the foot if they want.

5) No need for Dev to wait for the Prod admin to install updates, etc.

Dev should still have read-only access to Prod, however.

---
If this reply helps you, Karma would be appreciated.

somesoni2
Revered Legend

1) The load of DEV searches will not affect PROD indexers, giving better performance.
1.1) Any really bad search (which people often write during development) or realtime search may kill or make an indexer terribly slow.
2) Prevents accidental delete of PROD data from DEV SH.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...