Deployment Architecture

Can I specify another location for splunk to look for apps?

brent_weaver
Builder

I am working on automation and I would like to know if there is a way to configure splunk ALSO look to an alt directory (besides /opt/splunk/etc/apps) for configs. Like with the deployment server (which cannot be used btw to deploy) I can sync with the empty dir deployment-apps, therefore not deleting the existing files.

Hopefully this makes sense why I would need to do this!

Thanks.

Tags (1)
0 Karma

acharlieh
Influencer

As @hortonew suggested, what type of automation are you doing here, and what sort of system are you on? I have used symbolic links on *nix before to bring apps into a running Splunk system. But this was also for keeping my development dir outside of the Splunk install directory, and that has "worked" in the past, but I cannot speak as to how supported it would be.

hortonew
Builder

Can you walk through your automation? Is this automation on the universal forwarder level or on a splunk enterprise server? At what point do you need an empty directory for apps?

0 Karma

valiquet
Contributor

Don't write into system if you are in a distributed env. Better use apps. See bellow answer.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...