Deployment Architecture

Whats the best way to connect an already running search head to a new deployment server

tkwaller_2
Communicator

Hello

I have a small env( 2 indexers, 1 sh) that we are wanting to connect a new deployment server to the search head. I copied all the apps to the new deployment server. Moved the current SPLUNKHOME/etc/apps directory to SPLUNKHOME/etc/apps.old.whatever. Re-added the SPLUNKHOME/etc/apps directory. Added the deploymentclient.conf file. Restarted.
Waited for a connection:

06-07-2018 21:06:40.618 +0000 INFO  DC:HandshakeReplyHandler - Handshake done.

But the deployment server never saw a connection, at least not that I saw in the GUI. So I removed the apps directory and moved the old apps back to the apps directory. and restarted so all would go back to normal. It caused collections to break so I had to fix that but can you tell me:
Is there a better way to do this?

Thanks for the tips

0 Karma
1 Solution

tkwaller_2
Communicator

I figured it out. It wasn't actually an issue at all it just didn't connect and appear in the deployment server as fast as I had anticipated it would. Just took a bit longer but was successful.

Thanks again

View solution in original post

0 Karma

tkwaller_2
Communicator

I figured it out. It wasn't actually an issue at all it just didn't connect and appear in the deployment server as fast as I had anticipated it would. Just took a bit longer but was successful.

Thanks again

0 Karma

ansif
Motivator

Good that it resolved.

0 Karma

ansif
Motivator

You want a deployment server to manage your search head right?

Just place all your search head apps in deployment server $Splunk_Home/etc/deployment-apps directory.And as you mentioned the DS and SH already hand shook you will see all the deployment server apps deployed under /etc/apps dir of Search Head.

NB:- You should create a server class to include those apps for Search head.

0 Karma

tkwaller_2
Communicator

As stated I already did that. The issue it that even though it says it connected and did a handshake I never saw the connection in the deployment server in the clients list.

0 Karma

ansif
Motivator

Start with the basic troubleshooting:

telnet deployment server from Search head to the management port and vice versa(default 8089).
Check if services are running on both instance.Do a restart on both instance.
Check deploymentclients configuration file under Search Head.(paste it here)

Let me know if any progress.

0 Karma

somesoni2
Revered Legend

Did you create the necessary serverclass.conf entry for your search head and assigned those apps? Does SH can connect to your new DS, firewall wise?

0 Karma

tkwaller_2
Communicator

I did yes. I had the serverclass created but it should still connect and show up in the clients tab anyway. I checked ports and everything were open on 8089. Tested telnet including port.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...