Deployment Architecture

How do I distribute the search app bundles on a search head cluster?

xsstest
Communicator

In the search header cluster, we can use deployer to distribute app bundles

but I've always had a question.

If i need to update a configuration file on the search app. for example: I would like to add a lookup table in the search app /search/lookups/ or add a static file (.js) in the /search/appserver/static/ directory. So how should i do it?

A、copy $SPLUNK_HOME/etc/apps/search from search header to the $SPLUNK_HOME/etc/shcluter/apps/of the deployer
and then add the new lookup table or add a static file. Finally, through the splunk apply CLI to distribute the bundle

B、create a search directory directly under $SPLUNK_HOME/etc/shcluter/apps on the deployer, and then create the lookups directory in the search directory. Add a lookup table here, and finally through the splunk apply CLI to distribute the bundle

A and B, which method is correct?

Please forgive my English level, all the help would be appreciated.

0 Karma
1 Solution

xsstest
Communicator

create app on deployer,
then put your configuration file into the app folder and distribute it to the cluster members.
Finally, set the app for global sharing
Search app can share its configuration file in a shared way

View solution in original post

0 Karma

xsstest
Communicator

create app on deployer,
then put your configuration file into the app folder and distribute it to the cluster members.
Finally, set the app for global sharing
Search app can share its configuration file in a shared way

0 Karma

mwdbhyat
Builder

The search head cluster will replicate certain runtime changes by default(if you edit the lookup in the gui or if done by CLI and REST). Otherwise if you edit a lookup or static config file, put it on the deployer and then push the changes to all SHC members as normal.

See here for reference: http://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/HowconfrepoworksinSHC

0 Karma

xsstest
Communicator

I know that. I just want to ask: should I copy the search directory from the search app directory to depolyer, and then distribute the bundles?

0 Karma

mwdbhyat
Builder

If you are using the search app just copy whatever files you update into the search app folder on the deployer, alternatively you can create your own app and do that too.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...