As a Splunk SE, I had the privilege of working with some of the largest public sector customers. Many of these customers were running, or deploying, multi-terabyte Splunk infrastructures for complex enterprise environments. Oftentimes, these implementations were managed by large integrated project teams (IPT if you like a good TLA¹) and the byproduct of the project management activities were, among other things, spreadsheets.

It’s commonplace for Splunk admin teams to work from spreadsheets, particularly for tracking data source information and status. Although spreadsheets are fine for capturing such information, they are much less effective when used as a means of collaboration and communication.

The spreadsheet is dead!

We built the rqst app to provide new structure and visibility to Splunk project teams, admins, and users. The rqst app takes the place of the “tracker” spreadsheet and streamlines data source-specific collaboration. It provides a customizable form inside of Splunk for end-users to submit and monitor requests for data ingest. From an admin standpoint, Splunk engineers can easily filter, view, and interact with these requests, to include adding private notes, tags, and other information. Managers can better understand user needs, resource requirements, and the budgetary impact of individual requests or requests from specific parts of the organization.

All of these capabilities are provided inside of Splunk using only core capabilities, without any external dependencies and with no impact on your Splunk license.

Long live the spreadsheet!

If you are currently using a spreadsheet to track data sources, we can put it to work! With some massaging of field names and changing certain values to align to rqst’s conventions, your spreadsheet can be used to populate rqst. The import process is very simple and it can always be exported at any time. This allows you to bring all of the goodness of Splunk to bear for data source tracking while still having the ability to quickly generate a spreadsheet on demand, should it be required. (But let’s hope it never comes to that!)

Take it for a spin?

The rqst app is now available for download on Splunkbase. Grab a 30-day trial license and a copy of the rqst Admin Guide today. Contact us with any questions. We’d love to hear from you!

¹TLA = Three-Letter Acronym