About Eqalis

Eqalis · ‎01-06-2012

I tend to deploy 4 types of app. A site app as above, An OS app (unix,win,mac) for any operating system specific info, A splunk function app (UF, LWF, HWF, Indexer, SearchHead, DeploymentServer) and SOME server function apps defining Inputs etc. This gives maximum control and flexibility without becoming impossible to manage. It also means I can look at any deployment client in the app directory and see this server is for example in London, running Windows, is a LightWeightForwarder and collects IIS logs and perfmon.

Eqalis · ‎01-06-2012

You create an app that is specific to each site. Lets call them London and Sanfran. In each one you create the files that are specific to that site. I would at a minimum have an outputs.conf pointing to your local indexer and a deploymentclient.conf pointing to your local deployment server. That way devices in London get the London app, download config from the London DS and send data to the London indexer. Similarly devices in Sanfran get their app and connect to devices in Sanfran.

Eqalis · ‎01-05-2012

This can be done. You set up two deployment servers, one in each location. You set one as a client of the other and give it a server class to deploy all the deployment-apps directories to the deployment apps directory of the other. Give each client a site app which tells it where to deploy from and forward to. It should look somthing like this Site 1 Master Site 2 Slave Deployment Server Deployment Server Deployment apps dir----------------->Deployment apps dir | | | | Client A | Client B | v v apps dir apps dir ______|______ ______|______ | | | | Site1 app Other Apps Site2 app Other Apps The important thing is that the slave deployment server should reload whenever it gets a deployment app from the master. This forces it to deploy the new app to it's clients. With this setup, you only have one server polling across the wan and only deploy across it once per update.

Eqalis · ‎12-14-2011

Adding a missing path does cause a slight overhead as splunk has to try to scan it and wait for a response and this is worse if the drive is not local. If it is only one folder, I wouldn't worry but if more, I would consider having separate files for each server type. If you are going down that path, I'd consider using deployment server to manage which devices get which config.

Eqalis · ‎12-14-2011

Yes the editor on the forum seems to lose backslashes unless you are very careful .

Eqalis · ‎11-07-2011

Consecutive searches are not compared unless you chose to alert only if a count rises or drops by a value. So if you are not careful, you will get duplicate data

Eqalis · ‎11-07-2011

Yes if you schedule a search to run every 30 min, it uses the current now each time though in later versions they use cron style timing so it is less of an issue. Splunk recommend allowing a generous 5 min for this in the alert scheduling. So in your case you would run the alert every 30 minutes from 35 min ago until 5 min ago. If you want the report to show clean half hour blocks, schedule it to run at 5 past and 25 to the hour using custom/cron as 5,35 * * * * Bob

Eqalis · ‎06-23-2010

This was true of splunk before version 4.2. Now you can go to Manager >> Apps >> Install app from file If you have an older version of Splunk then you have the Python programming language at your disposal and a handy script called untarit.py. For an app file called "Foo.spl", type the following on one line: C:\Program Files\Splunk\Python-2.6>..\bin\python ..\bin\untarit.py ..\etc\apps\Foo.spl ..\etc\apps\ Note, you must be in the Python-2.6 directory for Python to be able to find all the modules it needs, hence all the horrible '..\' stuff.

Posts	8
Solutions	1
Karma Given	49
Karma Received	11
Member Since	‎06-23-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Re: Multiple Deployment Servers Configuration

Re: Multiple Deployment Servers Configuration

Re: Multiple Deployment Servers Configuration

Re: Forwarder Not Forwarding New Monitored Logs

Re: event log filter/chunk out at index time

Re: Alert period overlap?

Re: Alert period overlap?

Re: how to install downloaded Splunk apps on windo...