In the search header cluster, we can use deployer to distribute app bundles
but I've always had a question.
If i need to update a configuration file on the search app. for example: I would like to add a lookup table in the search app /search/lookups/
or add a static file (.js) in the /search/appserver/static/
directory. So how should i do it?
A、copy $SPLUNK_HOME/etc/apps/search
from search header to the $SPLUNK_HOME/etc/shcluter/apps/
of the deployer
and then add the new lookup table or add a static file. Finally, through the splunk apply
CLI to distribute the bundle
B、create a search directory directly under $SPLUNK_HOME/etc/shcluter/apps
on the deployer, and then create the lookups
directory in the search directory. Add a lookup table here, and finally through the splunk apply
CLI to distribute the bundle
A and B, which method is correct?
Please forgive my English level, all the help would be appreciated.
create app on deployer,
then put your configuration file into the app folder and distribute it to the cluster members.
Finally, set the app for global sharing
Search app can share its configuration file in a shared way
create app on deployer,
then put your configuration file into the app folder and distribute it to the cluster members.
Finally, set the app for global sharing
Search app can share its configuration file in a shared way
The search head cluster will replicate certain runtime changes by default(if you edit the lookup in the gui or if done by CLI and REST). Otherwise if you edit a lookup or static config file, put it on the deployer and then push the changes to all SHC members as normal.
See here for reference: http://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/HowconfrepoworksinSHC
I know that. I just want to ask: should I copy the search directory from the search app directory to depolyer, and then distribute the bundles?
If you are using the search app just copy whatever files you update into the search app folder on the deployer, alternatively you can create your own app and do that too.