Installation

Splunk etc app directories

dahlberg
New Member

I inherited a Splunk installation and I'm a little confused about the app directories in $SPLUNK_HOME/etc (I'm sure its probably answered in docs.splunk.com, and I've looked but I can't seem to find where this might be documented)

(1) I have both a standalone Splunk installation and an installation with a cluster manager. In each installation there is an "apps", "deployment-apps", "master-apps" and "system" directory in $SPLUNK_HOME/etc. When would I use each specific directory?

(2) Within "apps", "deployment-apps", and "master-apps", there are directories (that have the standard default/local/metadata subdirectories) called IA-appname and TA-appname where appname is something like "shibboleth" for data forwarded from Shibboleth servers. What goes in the IA dirs and what goes in the TA dirs?

(3) Is there a way (either CLI or Web GUI) to determine if the changes I've made or IA/TA subdirectories I've created have been incorporated into the Splunk configuration?

Thanks for any help/suggestions/links you can offer.

Mike

0 Karma

dhirendra761
Contributor
0 Karma

ddrillic
Ultra Champion

Because the Splunk Enterprise software package contains the Indexer, the Search Head, the Deployment Server, the Deployer and more, it gets tricky.

Therefore, it depends on the context - on the Deployment Server $SPLUNK_HOME/etc/deployment-apps contains all the apps to be distributed to the forwarders. On the Deployer Server, in a cluster, $SPLUNK_HOME/etc/shcluster/apps holds the apps to be distributed to the Search Heads. On the Search Head, $SPLUNK_HOME/etc/apps holds the apps themselves.

$SPLUNK_HOME/etc/master-apps is to distribute apps to the indexers - Manage app deployment across all peers

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...