- Splunk Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Temporarily disable deployment server?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am going to upgrade from 4.2.4 to 4.3 and the documentation recommends disabling the deployment server first and enabling it last. The problem is my summary jobs live on the same Splunk instance and so leaving the whole thing down while I upgrade five indexers is not feasible.
Is there some way to turn off the deployment server without causing all the deployment clients to remove their apps? I found something mentioning running "/opt/splunk/bin/splunk disable deploy-server" but I have no idea what this will actually do and how the deployment clients would behave.
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
not sure if this will work in your scenario, but you could (temporarily) turn up the phoneHomeIntervalInSecs interval on the deployment client side so that the clients won't check in during the time you're doing the upgrade.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Maybe you want $SPLUNK_HOME/bin/splunk disable deploy-server. See '$SPLUNK_HOME/bin/splunk help disable'
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, I mentioned that command in my original post. The help only states "deploy-server disable or enable deployment server capability" which as I noted doesn't tell me what it does. I am trying to ensure this will not cause the deployment clients remove the apps that came from the deployment server.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
if all you want is to know what happens when you run a command, you could just spin up a VM and run the command. that's literally what DEV environments are for...
[splunk@ClientMachine bin]$ ./splunk disable deploy-server
Your session is invalid. Please login.
Splunk username: admin
Password:
Login successful, running command...
Deployment Server is disabled.
[splunk@ClientMachine bin]$
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Would the deployment clients actually remove installed apps if they can no longer contact the DS? Or does the "disable deploy-server" differ in effect from a bad (i.e. blocking) fw-config (as seen from the client).
If that is the case, could one not set any fw between the DS and the clients to block incoming requests to port 8089 on the DS? This would still let search jobs run towards the indexers.
/k
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
not sure if this will work in your scenario, but you could (temporarily) turn up the phoneHomeIntervalInSecs interval on the deployment client side so that the clients won't check in during the time you're doing the upgrade.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Clever idea piebob!
Introducing the 2024 SplunkTrust!
Introducing the 2024 Splunk MVPs!
Splunk Custom Visualizations App End of Life
