Standard Configuration updates for Splunk Cloud

Applicability

Description

Splunk Cloud internally maintains a list of approved standard changes that can be requested at any time without additional approval. Any changes that fall outside this list may require special consideration or approval before implementation. After a Cloud Change Request is submitted, Splunk Support will determine the validity of the change prior to scheduling and execution.

Investigation

• Whenever Splunk Docs refers to contacting Splunk Support to implement a change, you may consider it an approved standard change request.

• Some changes are not allowed due to Splunk Cloud limits, security concerns, poor practices, or other reasons.

• If you're unsure about the change you need or whether a change is necessary to address your problem, open a General Issues Support case. Change specialists may not have the expertise required to properly assess your issue.

The majority of changes are easily manageable and can be implemented through self-service using the Web UI or a Private App.

Certain actions, integral to operational procedures, may necessitate assistance from Splunk Support. Examples of such changes include but are not limited to:

• Share DMAs between SHs
• Enabling Ingest Processor
• Synchronizing an index to IDM or SHs
• Removing local overrides
• Enabling Federated Search
• Activating HEC for AWS Firehose
• Setting default user timezone

Examples of changes that are deemed rejected, encompassing but not limited to:

• Editing Python Scripts
• Modifying 3rd Party or Private Apps
• DDAA on internal indexes
• Alterations to any /default/folder
• Changing mail host values

Resolution

1. Determine your standard maintenance window time frame for this change.
2. Navigate to the Support Portal.
3. Create a Support Case.
4. Select Support > Splunk Cloud > Cloud Change Request > Standard Configuration