Change Plans
Create, review, approve, and execute Splunk configuration changes across your fleet
Change Plans
Change plans bundle configuration changes for your Splunk fleet. Each plan goes through a lifecycle of creation, review, approval, and execution — giving you governance and traceability for every config change.
Navigation
- Parent: Automation Platform
- Previous: Insights Nodes
- Next: Executions
- Related: App Deployment Agent
Plans List
Navigate to Automation Platform → Plans to see all change plans. You can filter by status and search by plan name, ID, or commit SHA.
Plan Statuses
| Status | Meaning |
|---|---|
| Draft | Plan is being prepared — not yet submitted for approval |
| Pending | Submitted for approval — waiting for a reviewer |
| Approved | Approved and ready to execute |
| Executing | Currently being rolled out to target nodes |
| Completed | Successfully applied to all target nodes |
| Failed | Execution encountered errors on one or more nodes |
| Rejected | Reviewer declined the plan |
| Cancelled | Plan was cancelled before execution |
Plan Properties
Each plan displays:
- Plan name and description
- Source type — where the plan originated (manual, agent-generated, or Git-linked)
- Repository and commit — for Git-sourced plans, the linked repo URL and commit SHA
- Trusted source indicator — whether the plan comes from a verified source
- Destructive change warning — flagged when the plan removes or overwrites existing configs
- Approval trail — who approved or rejected the plan, and when
Creating a Plan
- Click New Plan on the Plans page.
- Enter a plan name and description.
- Add configuration changes — specify which files and stanzas to create, modify, or remove.
- Submit for approval or save as a draft.
Plans can also be created programmatically by the App Deployment Agent or via the Observer API.
Approval Workflow
Change plans require explicit approval before execution. This human-in-the-loop design prevents unreviewed changes from reaching production Splunk environments.
- A plan is submitted with status Pending.
- A reviewer inspects the proposed changes.
- The reviewer clicks Approve or Reject.
- Approved plans can then be executed.
Executing a Plan
Once approved, click Execute to begin rollout. The plan transitions through Executing → Completed (or Failed if errors occur). Track live progress on the Executions page.
