topic Re: deploying Dashboard apps, search apps(search phase) etc in Clustered envrionment in Deployment Architecture

deploying Dashboard apps, search apps(search phase) etc in Clustered envrionment

Mag2sub — Wed, 21 Aug 2013 22:28:10 GMT

Looking to leverage Index replication but still unsure on how to deploy apps with views,search time apps to participating indexers?,search heads

online documentation suggestes there are some limitation for Cluster apps in sense tknowledge bundel dont support search time artifacts ....so how does one actually achieve search time apps in Clustered environments..confused ...and appreciate pointers as i may be amiss on the caveats of CLuster apps ?

Re: deploying Dashboard apps, search apps(search phase) etc in Clustered envrionment

adrianathome — Thu, 22 Aug 2013 01:12:26 GMT

It depends on the app. Some of them will have to be installed in search head only. Others will have components that go on search pears and search head.

I thought it was going to be an issue but it really isn't. I guess it can be inconvenient that on search pears you can use the bundle but the search head will need to be a manual install.

Re: deploying Dashboard apps, search apps(search phase) etc in Clustered envrionment

Mag2sub — Thu, 22 Aug 2013 02:14:38 GMT

And there is not any way to make the search head a deployment client ?...it has to be manual only ?

I also did read up that Splunk also does not recommend any config management tool like puppet etc to be used to update cluster config ?...

Thanks

Re: deploying Dashboard apps, search apps(search phase) etc in Clustered envrionment

jkerai — Fri, 04 Oct 2013 18:31:45 GMT

Mag2sub, you may want to look at 6.0 as some of these limitations have been addressed.

Re: deploying Dashboard apps, search apps(search phase) etc in Clustered envrionment

JeremeyWise — Tue, 29 Sep 2020 07:21:33 GMT

I am going to glom onto this post and try to get better details then "depends" to the question. I understand that all outliers depend.. but lets keep this simple.

*NIX app How do you do deployment across a cluster designed NSPOF:
4 x Indexer
1 x Cluster mater
1 x Deployer / license server
3 x Search nodes in SH Cluster (VIP for HA)
2 x Heavy forwarders collecting syslog /snmp / json (VIP for HA on inbound)

I did read
Documentation:
http://docs.splunk.com/Documentation/Splunk/6.2.5/DistSearch/HowconfigurationworksinSHC

Design for file location:
splunkcmaster01 -> /opt/splunk/etc/masterapps/ (used for index node component deployment)
splunkdeploy01 -> /opt/splunk/etc/shcluster/apps/ (used for Search Head Cluster Nodes)
-> /opt/splunk/etc/deployment.apps/ (Forwarders)

Example: *NIX app deployment (via best practice)

Step 1: Download splunk-app-for-unix-and-linux_503.tgz onto splunkdeploy01
Step 2: copy files from within tarball out to different splunk directories

[root@splunkdeploy01 /]# cd /tmp/
[root@splunkdeploy01 tmp]# cp /media/labfiles/Software/Splunk/apps/splunk-app-for-unix-and-linux_503.tgz .
[root@splunkdeploy01 tmp]# tar -zxvf splunk-app-for-unix-and-linux_503.tgz
[root@splunkdeploy01 tmp]# cd splunk_app_for_nix/
?? < missing explaination of what dir / files goes where. I think /SA-nix goes in one folder and /TA_nix goes in another folder but also some parts go onto search head. > ??
[root@splunkdeploy01 /]# ls /tmp/splunk_app_for_nix/install/
SA-nix Splunk_TA_nix

Question:
1) README.txt within app has no info to guide on this procedure. And docs website does not speak to cluster type deployment. Is there a guide for or youtube for how this is done?

Once I get the answer for this I can post this.. and as I crawl through other apps deploy on cluster.. I can post that. (example DB connect , Exchange, VWare etc.. which say a lot of "deploy like standalone" but peices to the process are missing... or I am missing the "Very F*ine* Manual"