deployment server - systems/local

[carmackd]

Is it possible to push out updates to the system/local directory using the deployment server? I tried and ended up deleting the entire system directory on the client machine. Below are the configs I used.

deployment client

[deployment-client]
clientName = indexer01
serverEndpointPolicy = rejectAlways
targetRepositoryLocation = /opt/splunk/etc/

[target-broker:deploymentServer]
targetUri=192.168.32.80:8089

deployment server

path to deployment-app

/opt/splunk/etc/deployment-apps/system/local

[kevintelford · Accepted solution]

You may be able to, but for reasons you've discovered I would advise against it. You can always create an app to push out various configurations. The app can be as minimal as a few conf files in a dir, ex: ./myapp/default/*.conf

But also from above, your targetRepositoryLocation is /opt/splunk/ect/ not /opt/splunk/etc/system/local

[supersleepwalke]

Awesome! I didn't realize that the default indexes could be overridden by a normal app. That should solve it for me. Thanks!

[sowings]

It's not necessary to put volume configs for the default indexes in system/local. The local subdir of any old app (read: deployment server) will do. Conf files in the local subdir of an app override any conf files in a default directory (including system/default), and system/local rules them all. But since system/local can't (easily) be managed by the deployment server, this is why we typically install apps with their config settings in local.

TL;DR

I've used a DS app (with indexes.conf in local) to override the location of default indexes.

[supersleepwalke]

I have the same question, but your solution (using an app) does not solve it.

My problem is that I'm using a volumes configuration for all my indexes, using an app pushed to all my indexers. (The app is called "myindexers".)

However, the local indexes (e.g. _audit, _internal, etc.) are residing on the same disk as my custom indexes:

$ mount
/dev/mapper/db_dg-opt on /opt/splunk/var/lib/splunk type ext3 (rw)

Since the internal indexes don't use the volumes config, the disk will fill. I've been advised by people on the IRC channel to fix this by putting some overrides in system/local that force the internal indexes to use the volumes config instead of $SPLUNK_DB. That seems workable, but I'd rather do it with the deployment server if possible, rather than hand maintaining that file on my five different indexers.

So, in that situation, is the recommendation still to manually maintain system/local/indexes.conf?

Also, since this might be of benefit (truncated to just relevant parts):
$ /opt/splunk/bin/splunk cmd btool indexes list

[_internal]
coldPath = $SPLUNK_DB/_internaldb/colddb
homePath = $SPLUNK_DB/_internaldb/db
thawedPath = $SPLUNK_DB/_internaldb/thaweddb

[dev]
coldPath = volume:remote/dev/colddb
homePath = volume:local/dev/db
thawedPath = /opt/splunk/var/lib/splunk/dev/thaweddb

[volume:local]
maxVolumeDataSizeMB = 745942
path = /opt/splunk/var/lib/splunk

[volume:remote]
maxVolumeDataSizeMB = 3774873
path = /splunk_cold