Deployment Architecture

How to migrate savedsearches.conf from one search head cluster to another?

brent_weaver
Builder

I need to migrate two savedsearches.conf files to a new search head cluster:

/opt/splunk/etc/apps/search/local/savedsearches.conf
/opt/splunk/etc/users/212059627/search/local/savedsearches.conf

How do I do this in a way that will propagate throughout the other nodes as well as maintain ownership in the new environment? The username in the new environment that will own these is different, so I assume these needs to be stored in their ../etc/users/dir??!? I know I can use the deployement server to deploy these but then they do not get the proper permissions. I think the key is to migrate /opt/splunk/etc/apps/search/local/savedsearches.conf because that seems to allow this all to be seen from the cluster.

Any help is much appreciated.

0 Karma
1 Solution

badrinath_itrs
Communicator

Hi,

Please follow below steps to push your changes.

1./opt/splunk/etc/apps/search/local/savedsearches.conf

Copy this file to a new/existing app on your Deployer ( $SPLUNK_HOME/etc/shcluster/apps) and push the change from Search Head Deployer to the members.

  1. /opt/splunk/etc/users/212059627/search/local/savedsearches.conf

You can copy this file under the appropriate user ( $SPLUNK_HOME/etc/shcluster/users) folder on your deployer and push the change from Search Head Deployer.

For search head cluster, you should not be using deployment server to push changes to your search head members.

Refer below documentation for further details.
http://docs.splunk.com/Documentation/Splunk/6.5.0/DistSearch/PropagateSHCconfigurationchanges

View solution in original post

badrinath_itrs
Communicator

Hi,

Please follow below steps to push your changes.

1./opt/splunk/etc/apps/search/local/savedsearches.conf

Copy this file to a new/existing app on your Deployer ( $SPLUNK_HOME/etc/shcluster/apps) and push the change from Search Head Deployer to the members.

  1. /opt/splunk/etc/users/212059627/search/local/savedsearches.conf

You can copy this file under the appropriate user ( $SPLUNK_HOME/etc/shcluster/users) folder on your deployer and push the change from Search Head Deployer.

For search head cluster, you should not be using deployment server to push changes to your search head members.

Refer below documentation for further details.
http://docs.splunk.com/Documentation/Splunk/6.5.0/DistSearch/PropagateSHCconfigurationchanges

brent_weaver
Builder

Thanks guys this worked!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...