topic Re: Configuration pushing using Deployment Server Globally in Splunk Enterprise

Configuration pushing using Deployment Server Globally

Reddi694325 — Sun, 13 Sep 2020 04:28:31 GMT

Hi All,

I hope everyone doing good.

I have One deployment server and around 10,000 Universal forwarders in my environment. I need to update the server.conf configuration in all(10,000) Universal forwarders under the path $Splunk_Home$ /etc/system/local/server.conf . But when I try to deploy using app it is not deploying globally. Kindly help me with the same.

Thanks & Regards,

Reddy

Re: Configuration pushing using Deployment Server Globally

thambisetty — Sun, 13 Sep 2020 05:26:57 GMT

can you test deploying app to one universal forwarder ( create metadata directory inside app and create a file called local.meta content should be like below)

[]

export = system

after deploying, use btool to check whether this configuration is taking precedence over the one inside system local.

Re: Configuration pushing using Deployment Server Globally

ivanreis — Sun, 13 Sep 2020 06:16:03 GMT

Hi Reddy, The Deployment Server does not deploy changes to $Splunk_Home$ /etc/system/local/server.conf, all the apps by default are being deployed to $Splunk_Home$ /etc/apps/<app_name>.
The best practice is to create a new app, add the server.conf with the stanzas you need to update into the app and deploy it to one server for testing purposes. Avoid change/update the default files to prevent from service disruption or mismatch configuration. It’s recommended to run this test in a dev or sandbox environment to make sure this change will work as expected and it will not cause any issues to the production. If this help you to fix your issues, please give a like.

Re: Configuration pushing using Deployment Server Globally

isoutamo — Sun, 13 Sep 2020 06:51:04 GMT

There is also “trick” how to remove those from system local folder after you have installed new app to replace that. @richgalloway or @gcusello probably could give to you exact instructions?

r. Ismo

Re: Configuration pushing using Deployment Server Globally

richgalloway — Sun, 13 Sep 2020 17:42:16 GMT

As others have said, the deployment server cannot alter or replace anything in $SPLUNK_HOME/etc/system/local. At least not directly.

What some do is deploy an app that contains a new config file as well as a scripted input that deletes the same file in etc/system/local. While this is usually done with deploymentclient.conf, there's no reason it can't be used with other config files. Be careful, though, because server.conf has many more settings the deploymentclient.conf you must be very sure your new file replicates them all before deleting the system/local copy.

Once all of the forwarders are running the new config you can remove the script from the app.