Deployment Architecture

issue at time of changing deployment server information

rameshlpatel
Communicator

Hi,

I am facing issue at time of changing deployment server from A to B.

e.g. At time of installation of forwarders I added deployment.conf in system/default folder to point server A. Now I am planning to change deployment server information and expecting forwarder to point to server B. For this i have create folder deployApp inside deployment-app in A and add new deploymentclient.conf file which was pointing to B. But I am seeing that forwarders are pointing to both servers.

I fired command in forwarders ./splunk cmd btool deploymentclient list which showing me B server information.

Now I am not able to understand why it still pointing to A with B server ?

0 Karma

bwooden
Splunk Employee
Splunk Employee

As you know, there are several locations we can place configuration files. Splunk merges them at run time using a specific set of instructions based on file precedence to resolve conflicts (to determine the "winning" setting if it occurs in 2 or more files). The tool you used (btool) show the result of this merging as it exists on disk (NB: In some cases, when files on disk are changed, but Splunk has not been restarted, btool will show one thing while Splunk is using something else). The --debug flag is useful for showing from*where* the winning setting came.

./splunk cmd btool --debug deploymentclient list

It is also worth noting that files in default directories should never be edited, instead, copy the settings which are different to the local directory and modify those settings (they will "win" over default, per configuration file precedence.

Since deploymentclient is applied at the global context, this should be the order of operations for resolving conflicts.

1. System local directory -- highest priority
2. App local directories 
3. App default directories 
4. System default directory -- lowest priority

If you have everything in order per the above, and btool confirms that, you may just need to restart?

0 Karma

rameshlpatel
Communicator

I am installing this app from A server.

0 Karma

rameshlpatel
Communicator

Showing B server information.

C:\Program Files\SplunkUniversalForwarder\etc\apps\deploymentApp\local\deploymentclient.conf [deployment-client]
C:\Program Files\SplunkUniversalForwarder\etc\apps\deploymentApp\local\deploymentclient.conf clientName = Forwarder-local
C:\Program Files\SplunkUniversalForwarder\etc\apps\deploymentApp\local\deploymentclient.conf [target-broker:deploymentServer]
C:\Program Files\SplunkUniversalForwarder\etc\apps\deploymentApp\local\deploymentclient.conf targetUri = adcvdiodnw7012:8091

0 Karma

bwooden
Splunk Employee
Splunk Employee

./splunk cmd btool --debug deploymentclient list
will show which settings are coming from which file. But like The Highlander, "there can be only one" deployment server.

0 Karma

bwooden
Splunk Employee
Splunk Employee

If deploymentclient.conf is in $SPLUNK_HOME/etc/system/local/, that will trump any settings in $SPLUNK_HOME/etc/apps/deployment_client_app/

A Splunk instance cannot talk to two deployment servers at once. Allegedly.

0 Karma

bwooden
Splunk Employee
Splunk Employee

Can you paste the results of
./splunk cmd btool --debug deploymentclient list

(You can change your actual host names to "serverA" and "serverB" before sending)

0 Karma

rameshlpatel
Communicator

I want to change deploymentclient.conf file from deployment server by overriding default conf file with app conf file. which is not happening and its talking with both servers old and new one.

0 Karma

rameshlpatel
Communicator

Thanks for the command.

But i am overriding system/default/deploymentclient.conf with app/local/deploymentclient.conf. But still it taking default Deployment server A.

Why that so ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...