topic Re: Moving a TA from dev to prod in Splunk Enterprise

Moving a TA from dev to prod

jwhughes58 — Wed, 17 Feb 2021 17:54:00 GMT

I'm trying to figure out why I get a 404 error in setup after I move a TA from my dev to prod environment. The TA works in dev. I tar ball it and move it to prod. Before turning it on in prod I remove local/passwords.conf. I then start the TA. When I go to the TA setup I get a 404 not found error. I look in dev:8089 and find the information. It isn't in prod:8089.

To me it seems there should be a process that reads setup.xml at install, translates the information into Rest API entries, and runs the commands to enter the information into the back end. If anything fails it should generate an error. I couldn't find an error.

Is there something I'm missing?

TIA

Re: Moving a TA from dev to prod

richgalloway — Thu, 18 Feb 2021 14:10:54 GMT

When you transfer the app you must remove all files from the local directory. Settings in local tell Splunk the app is already configured and so prevent it from being re-configured in Prod.

Re: Moving a TA from dev to prod

jwhughes58 — Thu, 18 Feb 2021 15:46:57 GMT

Hi Rich,

Is there a document that I didn't find that explains that?

TIA,

Joe

Re: Moving a TA from dev to prod

jwhughes58 — Thu, 18 Feb 2021 19:04:39 GMT

Thanks. With that information I was able to prove that your suggestion works in my UAT environment. I also removed meta.local since I downloaded a Splunk written TA, untarred, and looked at the files. No local directory. No local.meta. After doing that in UAT and restarting, the local directory was created as was the local.meta. When I ran the setup it created the local passwords.conf.

Re: Moving a TA from dev to prod

richgalloway — Thu, 18 Feb 2021 19:13:38 GMT

It is not well documented. See https://dev.splunk.com/enterprise/docs/developapps/testvalidate/appinspect/appinspectreferencetopics/splunkappinspectcheck#Configuration-file-standards for the perhaps the best list of things to do to prepare an app to move to another instance. A lot of it is over-kill for an in-house app, however.