https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378768#M13915 <P>You want a deployment server to manage your search head right?</P> <P>Just place all your search head apps in deployment server $Splunk_Home/etc/deployment-apps directory.And as you mentioned the DS and SH already hand shook you will see all the deployment server apps deployed under /etc/apps dir of Search Head.</P> <P>NB:- You should create a server class to include those apps for Search head. </P> Mon, 11 Jun 2018 08:04:48 GMT ansif 2018-06-11T08:04:48Z https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378765#M13912 <P>Hello</P> <P>I have a small env( 2 indexers, 1 sh) that we are wanting to connect a new deployment server to the search head. I copied all the apps to the new deployment server. Moved the current SPLUNKHOME/etc/apps directory to SPLUNKHOME/etc/apps.old.whatever. Re-added the SPLUNKHOME/etc/apps directory. Added the deploymentclient.conf file. Restarted. <BR /> Waited for a connection: </P> <PRE><CODE>06-07-2018 21:06:40.618 +0000 INFO DC:HandshakeReplyHandler - Handshake done. </CODE></PRE> <P>But the deployment server never saw a connection, at least not that I saw in the GUI. So I removed the apps directory and moved the old apps back to the apps directory. and restarted so all would go back to normal. It caused collections to break so I had to fix that but can you tell me:<BR /> Is there a better way to do this? </P> <P>Thanks for the tips</P> Fri, 08 Jun 2018 16:44:59 GMT https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378765#M13912 tkwaller_2 2018-06-08T16:44:59Z https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378766#M13913 <P>Did you create the necessary serverclass.conf entry for your search head and assigned those apps? Does SH can connect to your new DS, firewall wise?</P> Fri, 08 Jun 2018 19:24:26 GMT https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378766#M13913 somesoni2 2018-06-08T19:24:26Z https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378767#M13914 <P>I did yes. I had the serverclass created but it should still connect and show up in the clients tab anyway. I checked ports and everything were open on 8089. Tested telnet including port.</P> Fri, 08 Jun 2018 20:08:08 GMT https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378767#M13914 tkwaller_2 2018-06-08T20:08:08Z https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378768#M13915 <P>You want a deployment server to manage your search head right?</P> <P>Just place all your search head apps in deployment server $Splunk_Home/etc/deployment-apps directory.And as you mentioned the DS and SH already hand shook you will see all the deployment server apps deployed under /etc/apps dir of Search Head.</P> <P>NB:- You should create a server class to include those apps for Search head. </P> Mon, 11 Jun 2018 08:04:48 GMT https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378768#M13915 ansif 2018-06-11T08:04:48Z https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378769#M13916 <P>As stated I already did that. The issue it that even though it says it connected and did a handshake I never saw the connection in the deployment server in the clients list.</P> Mon, 11 Jun 2018 16:35:10 GMT https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378769#M13916 tkwaller_2 2018-06-11T16:35:10Z https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378770#M13917 <P>Start with the basic troubleshooting:</P> <P>telnet deployment server from Search head to the management port and vice versa(default 8089).<BR /> Check if services are running on both instance.Do a restart on both instance.<BR /> Check deploymentclients configuration file under Search Head.(paste it here)</P> <P>Let me know if any progress.</P> Tue, 12 Jun 2018 06:59:04 GMT https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378770#M13917 ansif 2018-06-12T06:59:04Z https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378771#M13918 <P>I figured it out. It wasn't actually an issue at all it just didn't connect and appear in the deployment server as fast as I had anticipated it would. Just took a bit longer but was successful.</P> <P>Thanks again</P> Wed, 13 Jun 2018 13:16:16 GMT https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378771#M13918 tkwaller_2 2018-06-13T13:16:16Z https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378772#M13919 <P>Good that it resolved.</P> Thu, 14 Jun 2018 02:20:46 GMT https://community.splunk.com/t5/Deployment-Architecture/Whats-the-best-way-to-connect-an-already-running-search-head-to/m-p/378772#M13919 ansif 2018-06-14T02:20:46Z