App created in Master and deployed to indexers not visible in searchhead

[neltonk]

Hi, I have recently installed a Splunk cluster. My configuration is supposed to be 1 Master(also the licensing master) , 3 indexer peers, *1 search head : indexing turned off *. I have created a basic configuration bundle - a folder for myapp1 under in master-apps on the master node:
$SPLUNK_HOME/etc/master-apps/
_cluster/
default/
local/
/
indexes.conf

validated the bundle and on success applied to cluster. This created the index and app on the indexers. I had to make the app visible on the indexers however I don't see the app on the search head. How do I make sure the app is visible to users who will only login to the search head. is there another procedure for this? Please help.

Thanks,
Nelton

[woodcock]

To manually deploy the app to the search head, tar it back up like this:

cd $SPLUNK_HOME/master-apps
tar czvf SendMeToSearchHead.tgz ./YourAppDirNameHere

Then use whatever tool that you like to transfer it to your Search Head into $SPLUNK_HOME/apps and do this

tar xvf ./SendMeToSearchHead.tgz
rm -f ./SendMeToSearchHead.tgz

However, it is uncommon for any app with is_visible to be appropriate for both your Search Head and Indexer tier. I would stop and make absolutely sure that this is what you should be doing.

[neltonk]

Thanks a lot for your reply. If I package the app folder under master-apps on the master node. But this folder only has the indexes.conf and not the app.conf. is that ok?

[woodcock]

Yes, it is VERY common to deploy an indexes.conf app via master-apps to the slaves. It should have an app.conf but isn't necessary. You need the indexes.conf app on your Search Head, too, otherwise you will not be able to limit certain people/roles to certain index values because the Search Head will not know about all index values.

[neltonk]

And also I have disabled indexing on my search head, but the packaged app file will have the indexes.conf; will this be ignored?

[woodcock]

See combined comment above.

[neltonk]

How can I deploy the app that I created manually with an index to the standalone search head? is it possible that the app and the associated indexes be visible to the user on the search head? I am a bit confused after reading about deployer component of splunk. Should I be packaging the app to deploy to search head or use the deployer?

[adonio]

Hello there,

the Cluster Master distributes apps only to its Cluster Peers (Indexers) to their .../etc/slave-apps/ directory.
it does not distribute any configuration to the Search Peers (Search Heads)
you can add an app manually to the Search Head, or use a Deployment Server.

Hope it helps

[gcusello]

Hi neltonk,
Master Node manages only Indexers, not Search Heads (see http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Clusterdeploymentoverview ).
You correctly deployed App to indexers using Master Node but you have to manually install app on the Search Head.
Bye.
Giuseppe

[vivekg72]

Hi

How to deploy apps on Search Head manually ?

Thanks

[gcusello]

Hi neltonk,
you can pack your app (see http://dev.splunk.com/view/webframework-developapps/SP-CAAAEMY ) and then install it using the web interface [Apps -- Manage Apps -- Install App from file].
Otherwise (if you can restart your Search Head it's easier!) you can unpack your App in your PC (if packed) and then copy your unpacked app in $SPLUNK_HOME/etc/apps and then restart Splunk (see https://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall ).

Bye.
Giuseppe

[gcusello]

Deployer is used only in Search Head Clusters, not in stand alone SH.
In this case, you have to copy App in SH and restart Splunk.
How do you configured Your SH? Did you used the cluster instructions?
Bye.
Giuseppe

[neltonk]

Thanks a lot for all your patient replies

It is standalone implementation. I only configured the clustering for indexers according to splunk documentation. I have packaged the app folder from the indexer node and deployed to the SH but this only has app.conf . I restarted splunk on SH and the app is visible.

Is this correct?

or should I package the app folder under master-apps on the master node(as Woodcock suggested). But this folder only has the indexes.conf and not the app.conf

[gcusello]

Hi neltonk,,
You can use Master Node ONLY to deploy Apps to Indexers, not to other systems as Search Heads.
On stand alone Search Heads you can only manually install apps (really you could use a Deployment Server but it's mad!)

Let me know your architecture:

• you have two clustered Indexers,
• a Master Node that manages the cluster,
• a stand alone Search Head that is used by the users to query data on cluster, is it correct?

If you want to use an App on a Search Head configured to see the data on Indexers Cluster, you have at first to configure SH following the procedure described at http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Configurethesearchhead .

Then you have to manually copy your custom App on SH (using tar or any other way) at $SPLUNK_HOME/etc/apps and then restart Splunk.

In this way you have:

• data on clustered Indexers,
• App on SH,
• SH configured to search data on Clustered Indexers.

At the end, I don't understand what you mean saying: "I have packaged the app folder from the indexer node and deployed to the SH but this only has app.conf" because you cannot deploy an app to a stand alone SH from an indexer.

Bye.
Giuseppe

[neltonk]

Hi Giuseppe,
Thanks for the quick reply. How can I deploy the app that I created manually to the standalone search head? Will the app and the associated indexes be visible to the user on the search head?

regards,

Nelton