topic Re: How to use deployer to distribute $SPLUNK_HOME/etc/system/local config files in Splunk Enterprise

How to use deployer to distribute $SPLUNK_HOME/etc/system/local config files?

ndavis4 — Tue, 28 Mar 2023 22:23:38 GMT

I am trying to distribute $SPLUNK_HOME/etc/system/local/web.conf file to all my servers in my cluster with the (search heads, management nodes, search peers). I want to change the name of my cert files from the default

privKeyPath = $SPLUNK_HOME/etc/auth/splunkweb/privkey.pem
serverCert = $SPLUNK_HOME/etc/auth/splunkweb/cert.pem

I am using the following command.

splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

I have searched and found nothing on how to do this. Only for apps ($SPLUNK_HOME/etc/apps/)

Re: How to use deployer to distribute $SPLUNK_HOME/etc/system/local config files

yeahnah — Tue, 28 Mar 2023 21:45:24 GMT

Hi @ndavis4

Sorry, but this is not possible as the SHC deployer will only update apps in $SPLUNK_HOME/etc/apps/.

Some sort of automation (e.g. Ansible, Puppet) is better for this sort of config change, or as it's fairly static once changed, just work through each server and update manually.

Hope this helps

Re: How to use deployer to distribute $SPLUNK_HOME/etc/system/local config files

ndavis4 — Tue, 28 Mar 2023 22:25:20 GMT

Thanks. This is what I expected. No problem, it is a static change and I can make changes on each server.

Re: How to use deployer to distribute $SPLUNK_HOME/etc/system/local config files

ndavis4 — Thu, 30 Mar 2023 19:16:03 GMT

This is interesting.

https://docs.splunk.com/Documentation/Splunk/9.0.2/DistSearch/Forwardsearchheaddata

Discusses how to forward internal logs from search head cluster members. It appears to recommend using the deployer to propagate the outputs.conf file. The outputs.conf files sits in $SPLUNK_HOME/etc/system/local folder which the deployer can not propagate to. Am I reading this wrong?

Forward data from search head cluster members

You perform the same configuration steps to forward data from search head cluster members to their set of search peers. However, you must ensure that all members use the same outputs.conf file. To do so, do not edit the file on the individual search heads. Instead, use the deployer to propagate the file across the cluster.

Re: How to use deployer to distribute $SPLUNK_HOME/etc/system/local config files

yeahnah — Wed, 05 Apr 2023 00:35:39 GMT

Hi @ndavis4

Yes, it is possible to have configuration like outputs.conf pushed out via the deployer but it would still end up in an app space under SPLUNK_HOME/etc/apps, not under SPLUNK_HOME/etc/system/local. This is fine and would work, just watch out for any potential app and conf file precedence issues if there is more than one copy.