I inherited a rather messy Splunk deployment and within the next 2-6 months will be starting a project to reorganize our deployment to be more understandable for the next poor soul to inherit it.
Right now my focus is on fixing our indexes. We have a lot of data going to a lot of indexes and nobody seems to quite understand why what is going where. We are looking for resources and suggestions on Splunk best practices when it comes to indexes and how to separate data. I think I would like to be able to separate data based on type (Operating System, Network, Application, etc.) and there is also a data privacy concern where we need to separate data based on access (we don't want developers seeing customer info etc).
If you had the opportunity to completely revitalize your Splunk deployment where do you recommend getting started and how would you organize your indexes?
↧