This app allows you to search your knowledge objects (searches, props, dashboards, etc) much faster and in much more powerful ways than the "settings" menu in splunk.
And so on.
Note that you'll get the most out of this if you know how to write regular expressions.
On top of the above, this app allows you to track all changes to all your knowledge objects. You can see the changes to any knowledge object between any arbitrary dates in colourful diffs.
The changes are for the actual knowledge object as seen by the search head, not for the underlying .conf configuration files. This means for instance that changing the permission of a dashboard from private to shared doesn't look like the private dashboard vanished and an entirely new unrelated one appeared.
Change information is kept in the KV store. Nothing is indexed by splunk, so no consumption of your license.
No need for any third party software (such as git), and no need for access to the backend. This means this works just as well in Splunk Cloud as in Splunk Enterprise.
Yes and no. No in that this app is incredible value for the effort needed to set it up. That said, a proper implementation should really be done by splunk themselves (https://ideas.splunk.com/ideas/E-I-7) so our hacky approach has limitations.
Proper source control would show who made the change and ideally how (upgrade, GUI, REST, manually, etc), and potentially even allow for a peer review to happen before the change actually takes place in production. We are not aware of a way to do any of that, so this is just tracking changes after they happen.
The changes are polled every 15 minutes, so you might have to wait up to that much to see the latest changes.
Please check out the documentation page on my blog.
ConfManager 1.4.3
New health dashboard to explore the content of KV Stores (to facilitate managing their size)
Historical Command Search dashboard's drilldown now opens searches in the correct app context.
Stop missioncontrol from generating a lot of pointless KV Store collection change events.
Version 1.4.2:
Fixed a bug where CM_collections_changes was growing fast with useless entries. Check the health dashboard and if your CM_collections_changes is really big, run this search (time picker can be anything):
| inputlookup CM_collections_changes
| search change=*
| outputlookup CM_collections_changes
Version 1.4.1
Fixed the menu, that wasn't including the new dashboards introduced in 1.4.0
Fixed bug with the updated field
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.