topic Re: Using Splunk deployment server to deploy apps to index master in Deployment Architecture

Using Splunk deployment server to deploy apps to index master

brent_weaver — Thu, 09 Nov 2017 21:22:24 GMT

I would like to know if it is possible to use the splunk deployment server to manage index apps (.../etc/master-apps). There is a param in deploymentclient.conf:

repositoryLocation = $SPLUNK_HOME/etc/apps
* The location into which content is installed after being downloaded from a
  deployment server.
* Apps and configuration content must be installed into the default location
  ($SPLUNK_HOME/etc/apps) or it will not be recognized by
  the Splunk instance on the deployment client.
    * Note: Apps and configuration content to be deployed may be located in
      an alternate location on the deployment server. Set both
      repositoryLocation and serverRepositoryLocationPolicy explicitly to
      ensure that the content is installed into the correct location
      ($SPLUNK_HOME/etc/apps) on the deployment clientr
    * The deployment client uses the 'serverRepositoryLocationPolicy'
      defined below to determine which value of repositoryLocation to use.

This does not seem to work. I realize that I will need to still perform a bundle push.

Any thoughts are welcome!

Re: Using Splunk deployment server to deploy apps to index master

MuS — Thu, 09 Nov 2017 23:06:45 GMT

Yes, you can do such a thing with deployment client. It will put the apps into the repositoryLocation and that's it.
As you correctly mentioned the apply cluster-bundle must be done separately.

But, being able to do something and actually do it are two different things and I would not use deployment client function to copy apps onto the cluster master (my personal opinion). If possible use a different tool like Puppet or Chef or what ever is able to copy files into place and run a command afterwards for you.
And just to add, please don't use Puppet or alike to deploy configs directly to the cluster members 😉

cheers, MuS

Re: Using Splunk deployment server to deploy apps to index master

brent_weaver — Fri, 10 Nov 2017 02:09:51 GMT

Thank you for this info! I agree and haev resorted to using ansible to deploy apps to the master-apps dir, and then force a bundle push.

Thanks!

Re: Using Splunk deployment server to deploy apps to index master

esix_splunk — Fri, 10 Nov 2017 06:55:14 GMT

As @MuS says, dont push directly to the index peers. This bad practice. I have customers using automation to push to the master-apps folder on the Master Node, and then you can use rest or CLI to push the cluster bundles out.

Pushing these individually to indexers can cause numerous problems, including configurations being out of sync, invalid configuration errors causing Splunk not to start, and other issues that may manifest is bizaar ways that are not easy to troubleshoot...

Re: Using Splunk deployment server to deploy apps to index master

MuS — Wed, 15 Nov 2017 01:29:28 GMT

The reason I added this comment was at the SplunkTrust AMA at .conf 2017 some one asked why he gets all these weird errors when he puts the cluster configs on the peers using puppet 😉
The response was an in unison NO! and of course the SplunkTrust explained then why this should not be done.

Re: Using Splunk deployment server to deploy apps to index master

dkeck — Thu, 23 Nov 2017 11:51:09 GMT

Hi, I get that this may not be best way, but I implemented that the Cluster Master will get its apps from the Deploymentserver.

    repositoryLocation = $SPLUNK_HOME/etc/master-apps
serverRepositoryLocationPolicy = rejectAlways

This worked fine at the beginning, but know I get errors like:

 ERROR DeployedServerclass - name=test_app Failed to install app=test_app   
 ERROR DeployedApplication - Failed to install app=/opt/splunk/etc/master-apps/test_app; reason=Application does not exist: test_app

I read some old answers, that this could be a bug, since this is the most recent one, I hoped, that someone could tell me more about this.

Is this resolved? Should it work like this?

Kind Regards

Thank you

David

Re: Using Splunk deployment server to deploy apps to index master

kcepull2 — Tue, 05 Dec 2017 15:02:49 GMT

@dkeck: You need to add "stateOnClient = noop" to either the [serverClass:xxx] or [serverClass:xxx:app:yyy] stanzas to tell the Deployment Server to NOT try to "activate" the app once it is pushed to the Cluster Master. Since the apps are put in master-apps on the CM, they aren't active on the CM itself, so you don't want the DS trying to enable them. That should get rid of the errors you are seeing about "failed to install".

Re: Using Splunk deployment server to deploy apps to index master

nickhills — Tue, 05 Dec 2017 15:11:16 GMT

Just another +1
Just because you can do something, does not mean you should

Deployment Servers Manage Forwarders
Deployers Manage Search Head Clusters
Cluster Masters Manage Search Clusters
Only (even if you can technically)

Ask me how i know!

Re: Using Splunk deployment server to deploy apps to index master

dkeck — Wed, 06 Dec 2017 06:53:56 GMT

Ok I see.

Is there a better way to managed this? I really don´t want to add this stanza everytime I add an new app, and I don´t want to add this to 20+ serverclasses I already have.

Maybe the better way is, to disable deployment for CM.

Re: Using Splunk deployment server to deploy apps to index master

MuS — Wed, 06 Dec 2017 09:20:33 GMT

As mentioned before, use another tool to do this like Chef, Puppet or .... even scp or rsync can do the job.

Re: Using Splunk deployment server to deploy apps to index master

gjanders — Wed, 06 Dec 2017 22:24:10 GMT

kcepull2's solution will work, and yes it's per application, you could try to minimize the number of applications you deploy to your cluster master.

Many Splunk applications need only to be on the search head cluster and/or heavy forwarder, only some have index-time props/transforms/indexes configuration.
For these you also have the option of putting the configuration into a common application...

Also MuS's solution is of course valid as well...if you prefer that path...(apetite by bridgewater would be yet another product you could use)

Re: Using Splunk deployment server to deploy apps to index master

brent_weaver — Thu, 07 Dec 2017 03:47:40 GMT

I am just going to stick with my original plan to just use ansible to manage index cluster apps.

Re: Using Splunk deployment server to deploy apps to index master

woodcock — Thu, 28 Jun 2018 02:28:42 GMT

Read what he said; you can put it in the parent section and then it will apply to all apps.