Smart AnSwerS #47

Hey there community and welcome to the 47th installment of Smart AnSwerS.

Team support at HQ will be doing its first ever Secret Cut-throat Santa (aka white elephant) gift exchange this Thursday, and all of HQ will be celebrating Festivus next week…but alas, I’ll be missing out on everything since I’ll already be out of town to visit home. It seems like this year has flown by incredibly fast, and it’s hard to believe this blog series is now just over a year old already! *confetti* With the holidays fast approaching, enjoy this last Smart AnSwerS installment for 2015 and see you all in the new year :)

Check out this week’s featured Splunk Answers posts:

How to map existing sourcetypes to CIM data models?

SplunkTrust member Runals asked and answered the question to share this useful solution with the community on how to map existing sourcetypes to CIM data models. He lays out a detailed answer using his very own Data Curator app from Splunkbase to get the job done. Runals also points out that he is open to feedback on this approach, so drop in on the thread to provide constructive comments or upvote if this current solution was everything you ever hoped and dreamed for.

What is the curl command used on the deployer to apply shcluster-bundle?

tsunamii needed to know how to apply a shcluster-bundle command on the deployer, but in the form of a curl command. jreuter from Splunk support answered with just that, showing the example syntax and what values to replace as needed for any user to adapt. tsunamii confirmed this worked on a Splunk 6.2.5 search head cluster, and another user ben_leung confirmed it worked in his Splunk 6.3.1 environment.

What are your deployment app naming conventions?

awurster was looking for some inspiration or guidelines on namespaces when deploying apps from the deployment server, so he asked the community to see what standards other users were following. Check out the answers by williamwar and Colin Humphreys as both explain what they do for their respective environments and why. If you have your own naming conventions you feel would be helpful for the rest of the community, by all means, share away!

Thanks for reading, happy holidays, and have a happy new year!

Missed out on the first forty-six Smart AnSwerS blog posts? Check ‘em out here!