The Victoria Experience

About Victoria Experience

It's important to understand how Victoria is different from the Classic experience, as well as what new capabilities we are introducing with the new experience that you can take advantage of after your migration.

The Splunk Cloud Platform Victoria Experience is a building block in Splunk’s journey toward a cloud-native service model and a simpler, more intuitive experience for Splunk Cloud Platform admins and users. There are three main pillars of the Victoria Experience:

1. Self-service - Victoria Experience provides Splunk Cloud Platform admins with a seamless, fast and intuitive way to manage common platform features like apps, add-ons, HEC tokens and indices.
2. Simplified maintenance - Victoria Experience has numerous improvements that reduce the frequency and length of maintenance windows.
3. Increased elasticity and feature richness - Victoria Experience contains scalability improvements across the indexing and search service tiers.

The main benefits of Victoria Experience include:

1. Self-service app installation - you'll no longer need to submit support tickets for app installation. More than 99% of the apps listed in the In-Product App Browser (IPAB) can be installed directly through the self-service UI.  More information on how to use the IPAB can be found here.
2. Self-service private app vetting - accelerates creation and availability of private apps with an integrated vetting of the private apps.
3. Reduced service degradation during maintenance windows - tracking of search and replication factors are no longer required.
4. Reduction in skipped searches - delivers improved performance.
5. Modern, cloud-native API - built for common SC-Admin use cases (HEC and Index management, private app CI/CD)

Victoria Experience availability

Like many new capabilities in Splunk Cloud Platform, we are rolling out Victoria Experience based on a number of different criteria. We will review that criteria and link to additional resources that will be updated as that criteria expands.

Splunk Cloud Platform Victoria Experience is currently rolled out to thousands of customers in Splunk Cloud Platform, but requires a number of prerequisites to qualify for a migration to Victoria Experience.

As of March 2022, Victoria Experience is available in Splunk Cloud Platform AWS, exclusively in the following regions:

• AWS us-east-1
• us-west-2
• eu-central-1
• ap-southeast-2
• eu-west-1
• eu-west-2
• eu-west-3
• ca-central-1
• ap-northeast-1
• ap-southeast-1

There are also some eligibility requirements at the Splunk Cloud Platform level to also be aware of, such as:

• Premium apps & versions - currently limited support for cloud stacks with Splunk ITSI 4.10.0 or greater, Enterprise Security (ES) version 6.6.2 or greater is required for Victoria Experience
• Number of IDMs - must be 1 or fewer
• Splunk Cloud version - 8.2.2111 or greater
• Hybrid search - cannot actively be using hybrid search and must be migrated to federated search 

As we continue to make Victoria Experience more widely available, we will update this page and the docs pages with changes.

What to expect before migration

Once your Splunk Cloud Platform stack has met the prerequisite criteria for migration to the Victoria Experience, here are a few things to be aware of before the migration:

• The Operational Contacts and Support Entitlement contacts for your Splunk Cloud Platform stack will receive an email and support case indicating the date, time and duration of your maintenance window for your Victoria Experience migration. These will be sent at 6, 4 and 3 weeks prior to your scheduled migration.

• If you have an Inputs Data Manager (IDM) as part of your stack, ensure that you update any downstream services that have "allow listed" the IP address of your IDM to now use the IP address of your Splunk Cloud Platform search heads.
• If you are currently using hybrid search, you will need to move to federated search. 
  • Our current pre-checks indicate if you're regularly using hybrid search, and normally results in a removal from the migration candidate list. However, if you use hybrid search infrequently, there is a small chance this is overlooked. Additional details for federated search can be found here.

What to expect during migration

During the migration, which takes an average of four hours, all of the Splunk Cloud Platform related changes will be done by Splunk on your behalf.

Here are a few main things for you to be aware of during and after the migration:

• Victoria Experience stacks do not have a standalone Inputs Data Manager (IDM) node. All of your IDM configurations will be migrated to your search head, including inputs and credentials. 
  • In order to preserve the performance of your search workloads, your migrated inputs will be subject to default workload management pools and rules.
  • Your search head instance(s) will also be resized with additional memory and CPU resources to handle the additional load.
  • Your IDM node will be terminated and you will no longer log into it. You now manage your scripted and modular inputs directly on the search head.
• The majority of your Splunkbase and private apps will be moved to a self-managed model.
  • This means you no longer need to open a support request and schedule a maintenance window for app installations, upgrades and deletions. Continue to use the In-Product App Browser (IPAB) to install apps - you will simply see that more apps show the "green" installation button compared to "Classic". However, premium apps will continue to be managed by Splunk Cloud Platform operations.
  • There may be some search degradation over the course of the maintenance window. This may manifest itself as intermittent inaccessibility of the search head(s).
• There should be no impact to ingestion or indexing during the maintenance window. The indexing tier will perform a rolling restart, but will not impact ingestion or indexing of your data.

Key milestones and steps

Ensure your support entitlement and operational contacts are up to date, as you will receive a notification at 6, 4, and 3 weeks prior to the scheduled maintenance window. Your Splunk account contacts are also copied on these communications.

You must acknowledge the notification at least 2 weeks prior to the maintenance window in order to move forward with the migration, or the migration will be automatically canceled and rescheduled for a future date.

You'll receive a communication 24 to 48 hours after the migration completion asking for your feedback on the the scheduling and communication process, and you should also submit support tickets if any technical issues arise.

We are excited for all of the new innovations we are able to deliver to our customers with the Victoria Experience, but also understand that planning for this change can be complex. Please reach out to your customer success and account teams if you would like to know more about Victoria Experience or the migration specifically.