Deployment Architecture

Whats the best way to connect an already running search head to a new deployment server

tkwaller_2
Communicator

Hello

I have a small env( 2 indexers, 1 sh) that we are wanting to connect a new deployment server to the search head. I copied all the apps to the new deployment server. Moved the current SPLUNKHOME/etc/apps directory to SPLUNKHOME/etc/apps.old.whatever. Re-added the SPLUNKHOME/etc/apps directory. Added the deploymentclient.conf file. Restarted.
Waited for a connection:

06-07-2018 21:06:40.618 +0000 INFO  DC:HandshakeReplyHandler - Handshake done.

But the deployment server never saw a connection, at least not that I saw in the GUI. So I removed the apps directory and moved the old apps back to the apps directory. and restarted so all would go back to normal. It caused collections to break so I had to fix that but can you tell me:
Is there a better way to do this?

Thanks for the tips

0 Karma
1 Solution

tkwaller_2
Communicator

I figured it out. It wasn't actually an issue at all it just didn't connect and appear in the deployment server as fast as I had anticipated it would. Just took a bit longer but was successful.

Thanks again

View solution in original post

0 Karma

tkwaller_2
Communicator

I figured it out. It wasn't actually an issue at all it just didn't connect and appear in the deployment server as fast as I had anticipated it would. Just took a bit longer but was successful.

Thanks again

0 Karma

ansif
Motivator

Good that it resolved.

0 Karma

ansif
Motivator

You want a deployment server to manage your search head right?

Just place all your search head apps in deployment server $Splunk_Home/etc/deployment-apps directory.And as you mentioned the DS and SH already hand shook you will see all the deployment server apps deployed under /etc/apps dir of Search Head.

NB:- You should create a server class to include those apps for Search head.

0 Karma

tkwaller_2
Communicator

As stated I already did that. The issue it that even though it says it connected and did a handshake I never saw the connection in the deployment server in the clients list.

0 Karma

ansif
Motivator

Start with the basic troubleshooting:

telnet deployment server from Search head to the management port and vice versa(default 8089).
Check if services are running on both instance.Do a restart on both instance.
Check deploymentclients configuration file under Search Head.(paste it here)

Let me know if any progress.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Did you create the necessary serverclass.conf entry for your search head and assigned those apps? Does SH can connect to your new DS, firewall wise?

0 Karma

tkwaller_2
Communicator

I did yes. I had the serverclass created but it should still connect and show up in the clients tab anyway. I checked ports and everything were open on 8089. Tested telnet including port.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...