Search your knowledge objects

This app allows you to search your knowledge objects (searches, props, dashboards, etc) much faster and in much more powerful ways than the "settings" menu in splunk.

Ever wondered where a specific macro is used, be it in searches, dashboards, panels, other macros...?
Ever wondered what is populating this lookup and/or what is using it?
Ever wondered how many searches (or correlation searches) are using datamodel XYZ?
Ever wished that you'd remember which dashboard does that super cool complicated thing you want to do again now so that you can use it as inspiration / copy-and-paste?
Ever getting confused about the search-time configuration sequence and wished you could see all field extractions, aliases, calculations etc applied to a specific sourcetype or by a specific app in the right order?
Ever wanted to use grep in your etc folder?
Frustrated you can't see the eval code for calculated fields in a data model when not an admin?

And so on.

Note that you'll get the most out of this if you know how to write regular expressions.

Change tracking / versioning of all knowledge objects

On top of the above, this app allows you to track all changes to all your knowledge objects. You can see the changes to any knowledge object between any arbitrary dates in colourful diffs.

The changes are for the actual knowledge object as seen by the search head, not for the underlying .conf configuration files. This means for instance that changing the permission of a dashboard from private to shared doesn't look like the private dashboard vanished and an entirely new unrelated one appeared.

Change information is kept in the KV store. Nothing is indexed by splunk, so no consumption of your license.

No need for any third party software (such as git), and no need for access to the backend. This means this works just as well in Splunk Cloud as in Splunk Enterprise.

Is this too good to be true?

Yes and no. No in that this app is incredible value for the effort needed to set it up. That said, a proper implementation should really be done by splunk themselves (https://ideas.splunk.com/ideas/E-I-7) so our hacky approach has limitations.

Proper source control would show who made the change and ideally how (upgrade, GUI, REST, manually, etc), and potentially even allow for a peer review to happen before the change actually takes place in production. We are not aware of a way to do any of that, so this is just tracking changes after they happen.

The changes are polled every 15 minutes, so you might have to wait up to that much to see the latest changes.

Documentation

Please check out the documentation page on my blog.

Conf Manager

0