Deployment Architecture

Deployer overwritting app configuration

coreyf311
Path Finder

I created a barebones app on the deployer, copied it to shcluster/apps directory and pushed it to the 6 nodes of our SHC. Then, I configured the app from within the SHC with saved searches, dashboards, setup the NAV bar the way I wanted, etc. Same thing I have done many many times. A second push from the deployer seems to reset this app back to barbones. All the previous configuration is gone. This happened twice. Configured the app and it gets reset back to barebones after another push from the deployer.

splunk enterprise version 7.0.2

Tags (1)
0 Karma
1 Solution

coreyf311
Path Finder

turns out an old, thought to be decomm'd server that WAS our old deployer was turned on again and pushing bundles to the SHC via a script we have running. DOH

View solution in original post

0 Karma

coreyf311
Path Finder

turns out an old, thought to be decomm'd server that WAS our old deployer was turned on again and pushing bundles to the SHC via a script we have running. DOH

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How are you configuring those searches/navigations, updates from Splunk Web UI or directly on filesystem of the SHC members? If directly on file system, which app sub directories (default or local) you're creating those objects?

0 Karma

coreyf311
Path Finder

Splunk Web. I can confirm that the changes where replicated to all members before being wiped by the deployer.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Whats the app.conf value you're using on SHC Deployer (with your barebones app directory)? I use something like this and it works fine.

[install]
state = enabled

[ui]
is_visible = 1
label = App Title

[launcher]
author = AuthorName
description = App Description
version = 1.0
0 Karma

coreyf311
Path Finder

[install]
is_configured = 0

[ui]
is_visible = 1
label = App Title

[launcher]
author = AuthorName
description = App Description
version = 1.0

This is how the app.conf was configured when I created the barebones app in the deployers splunk web. Its the same as many many other apps we have created in the same fashion and pushed out. Once the barebones app is pushed to the cluster, we do the configuration with the SHC. None of these other apps have the same issue.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...