u/EmpatheticBookCover

Working on a large Splunk Cloud engagement (Classic Experience, ES on the premium search head) and want a sanity check on a design decision.

Normally I'd go the Add-on Builder route for CIM tag/eventtype work. Problem is Classic doesn't support self-service app install on premium search heads, so every TA push to the ES SH means a Support ticket as I understand it. This would slow us down and add a lot of overhead.

Right now we're building tags/eventtypes directly in the ES app via Settings (globally shared).

Curious how others have handled this:

• Anyone doing continuous TA pushes via Support tickets and it's not as painful as it sounds?
• Has an ES upgrade ever clobbered custom local tags/eventtypes living in the ES app, or is that risk overstated?
• Better middle ground I'm missing?

Thanks!