Administering Splunk Apps and Users

—In this chapter, we will round out our administrative duties by learning how to distribute Splunk apps and set up our users and their roles so that they can access the data in Splunk, and have a place (a Splunk app) to save and use the reports, dashboards, and alerts they'll build using this data. We'll also spend a little time discussing how to best manage and support your Splunk environment in terms of financial and administrative resources so that it keeps running in top shape.

The topics covered in this chapter include:

• How to distribute Splunk apps from a deployer
• Configuring users and roles to grant access to Splunk functionality
• Best practices for managing data in Splunk
• Supporting your Splunk deployment

Let's go!

Using the deployer

The deployer is used to distribute apps and user files to search head-cluster members. This occurs when you execute a command to apply a new or updated configuration bundle that you have prepared; it also occurs when a search-cluster member joins or rejoins the cluster—it contacts the deployer to see whether there are any updates it needs to download—so that all search-cluster members always have identical configurations.

The deployer function in a small Splunk installation can reside on another supporting member, such as a cluster master or license master. In larger deployments, it should be a dedicated instance, mostly because the other dedicated instances will be pretty busy performing their respective functions.

The configuration bundle created and distributed to search cluster members by the deployer is not the same as the configuration bundle...

Configuring users and roles

Now that you have a working Splunk Enterprise environment, you will need to configure users to give them access to Splunk search heads, and assign roles to each user to control what levels of access and control they have in the environment. For small installations, you may choose to configure users with only Splunk own authentication controls; for larger installations, you'll likely use Lightweight Directory Access Protocol (LDAP), SAML (Security Assertion Markup Language), or one of the other available authentication methods.

Splunk authentication

Splunk authentication is on by default, and remains on even if you select one of the other authentication methods. This means that even if you have...

Best practices for administering Splunk

To avoid distractions in the previous sections of this chapter and in Chapter 4, Getting Data into Splunk, I've reserved a few additional comments on topics you will want to consider for establishing some best practices as you administer your Splunk environment, understanding of course that these have to be tailored to your particular organization's culture, needs, and IT environment.

Let's first talk about developing a naming convention for indexes and source types. A search of the web will provide a number of discussions and ideas on the topic; here are a few options I've settled on.

Index naming conventions

When creating indexes, use lowercase names (Splunk changes...

Supporting your Splunk Deployment

As important and challenging as setting up an efficient Splunk environment is, it is equally important - and sometimes just as challenging - to ensure that you have taken adequate measures to fund and support your Splunk solution so that it continues to provide value well into the future. We'll address several of the most important points in this section.

Splunk support personnel

As a rule of thumb, Splunk recommends a minimum of three Splunk support personnel for any significant Splunk deployment. With the following roles and related training/certification and experience, these roles and duties can overlap or be altered depending on the needs of the organization and skill sets within...

Summary

This was a relatively short but important chapter! After learning how to deploy apps to search-cluster members with the deployer, we discovered how to set up user authentication and define the various roles to control access to Splunk and its various capabilities. Finally, I offered a few best practices on administering your Splunk environment and some key considerations for supporting it into the future.

If you've waded through (and hopefully experimented with) all the functionality in this chapter and Chapter 4, Getting Data into Splunk, you now know how to expertly administer all of the Splunk components in a clustered, distributed environment. In addition, you understand how the various configuration settings for each function are represented in the .conf files for each component, as well as a great deal about how Splunk actually executes the administration tasks...