Splunk Enterprise 6.6 New Features – Part I

Splunk 6.6 introduces new features in Data Visualization, Indexer and Search Head Clustering, Knowledge Object management and more to enhance user experience. This series of Splunk 6.6 blog postings explores some of these new features in detail.

These new features bring further capabilities to the UI (User Interface) for interacting with data efficiently. On the back-end stability improvements to ensure data flow continues without interruptions.

New Features in Splunk 6.6

The following table lists the new features in Splunk 6.6:

User Experience Dashboard Search Assistant
Dashboard Drilldown UI Editor
Trellis Layout
Search Editor Enhancements
Dataset Explorer
Platform Indexer Clustering Enhancements
Search Head Clustering Enhancements
Management Knowledge Object Reassign
Search Head Clustering UI

To analyze the new features, we created a virtual Splunk environment. The environment includes: Search Head Cluster (3 Search Heads), Indexer Cluster (2 Indexers), 1 Deployer, 1 Master node, 1 Monitoring Console (MC).

Reassign Knowledge Objects

Splunk 6.6 comes with a great new feature, Reassigning Knowledge Objects (KO), allowing the admin to migrate KO’s individually or in bulk from one Splunk user to another. Ownership of objects such as: reports, alerts, macros, tags, fields, advanced search can be changed from the UI. The admin can also reassign ‘orphaned’ KO’s.

Removing a user from the system or deactivating their account results in knowledge objects they previously owned becoming orphaned. KO’s such as scheduled reports are unable to run due to no ownership. In previous versions, if you wanted to have these orphaned knowledge objects re-assigned to another user, the Splunk admin would have to update configuration files manually.

To demonstrate this capability, as a Splunk admin, navigate to ‘All Configurations’ in knowledge section of the Settings menu.

navigation menu

At the top of the table, you can find a ‘Reassign Knowledge Objects’ option which navigates you another page, listing all KO’s assigned and orphaned by users who were removed no longer in the system. The Reassign KO page allows you to toggle between filtering KO by app, ownership, object type or via simple word search.

reassigning knowledge objects

On the same page, we narrowed down the search for all KO’s created by user ‘urwah’ in the search app. We get the option to reassign KO’s individually or in bulk.

reassigning knowledge objects

Select the new owner as admin and save for the changes to take effect. As we set up the KO ownership in the Splunk instance, the configurations will automatically synchronize with other members of the Search Head Cluster.

reassigning knowledge objects

This new functionality in Splunk 6.6 makes it simple to migrate alerts, saved searches, macros, between users.  Admins should keep in mind that reassigning knowledge objects can allow access to previously inaccessible data. It may not work in coherence with existing objects due to roles restrictions. Objects should always be examined before reassigning ownership to maintain data integrity.

 

Looking to expedite your success with Splunk? Click here to view our Splunk service offerings.

© Discovered Intelligence Inc., 2017. Unauthorised use and/or duplication of this material without express and written permission from this site’s owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Discovered Intelligence, with appropriate and specific direction (i.e. a linked URL) to this original content.