Splunk Enterprise

How to Deploy ui-pref.conf in Search Head Cluster using Deployer?

sat94541
Communicator

We have need to set ui preference with default time range picker globally across of the searches run in Splunk. We need to deploy these configuration across all three search Head Cluster Member in SHCM (search Head Cluster Memeber Pool)

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Deployed application named "search_head_pushed_config" from deployer to Search head Cluster members.
The app has the following configuration was specified in ui-prefs.conf :
[default]
dispatch.earliest_time = -15m
dispatch.latest_time = now
display.prefs.enableMetaData=0
display.prefs.showDataSummary=0

The config was pushed to the search cluster.

Note : Also for the App, “search_head_pushed_config” enabled settings for exporting globally by defining folloing, If not, its ui-prefs.conf will not be visible to other apps, which will prevent the timepicker customizations from applying in other app contexts.

$SPLUNK_HOME/etc/shcluster/apps/search_head_pushed_config/metadata
[]
Export=system

This behavior is similar to non -cluster Search head.


cramasta
Builder

So when you say to put these setting in $SPLUNK_HOME/etc/shcluster/apps/search_head_pushed_config/metadata Im guessing you mean the default.meta file?

What would happen over the course of time if I start adding new knowledge objects to the search_head_pushed_config app from the Splunk UI which creates a local.meta file, and then one day i push a update to this app from the deployer, will it delete my local.meta file since my deployer metadata folder only contains the default.meta? Im just now setting up my Search Head Cluster and still reading the docs but I haven't yet read anything that talks about how the metadata folder is handled if its managed by the deployer. The topics that are stressed that i read so far is what happens with the default and local directories.

Thanks,
J

0 Karma

Lucas_K
Motivator

Local search head ui modified local.meta is immune to deployer based changes.

Deployer merges all "local" based configurations into defaults. This includes local.meta which will be merged with default.meta.

It's best to try and have just the one meta file regardless so it is perfectly clear what the detault.meta will be when it is deployed to members.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...