Is managing your growing list of indexes like herding cattle? Is your Master Node struggling against a stampede of buckets? Are you ducking bullets to satisfy data access requirements at the expense of usability or search performance? This session will demonstrate the advanced, role-based data access approach being used by several large Splunk customers. You will learn alternative methods to satisfy complex data access requirements without having to allocate hundreds or thousands of indexes. This method will allow you to focus on usability and search performance as your primary criteria for designing and managing your indexing strategy.
Slides PDF link - https://conf.splunk.com/files/2019/slides/FN1081.pdf?podcast=1577146201