I have a use case in my company where we have someone who has certifications in Splunk and wants to help his organization by developing and testing TAs for use with the data we are ingesting from his forwarders. The issue with this of course, is that you would have to provide a user like this administrative rights so that they would be able to create their own Apps.
I was wondering how other companies have managed cases like this?
We currently have a clustered environment, and one of the suggestions that I had received was to provide admin rights to a user on a single indexer. This way they can test their data and allow them to bring data there and play with data. We can also open this indexer to have internet access so they can download any app or TA they want. This way that group of 'semi-admins' will have the ability to do their testing without having access to the entire cluster as a semi-admin. When they are ready to promote their app, they then engage the splunk admins to move to prod.
Would there be feasibility in this? Are there better ways of managing this?
↧