topic System-wide conf on Indexer Slaves in Deployment Architecture

System-wide conf on Indexer Slaves

morethanyell — Wed, 26 Jun 2019 23:29:08 GMT

If the configuration I wanted to distribute to the indexer slaves is not targeted to ../slave-apps, how should it be done, then?

The conf I'm trying to distribute is web.conf with below setting

[settings]
startwebservice = 0

The cluster master will put it on ../etc/slave-apps, not on ../etc/apps

Thank you in advance.

Re: System-wide conf on Indexer Slaves

MuS — Thu, 27 Jun 2019 00:04:08 GMT

Hi morethanyell,

put your config in this directory:

$SPLUNK_HOME/etc/master-apps/_cluster/local

This will still be in slave-apps on the peers but has the highest precedence.
I'm not aware of any Splunk configuration method for an index cluster that will put configs from etc/master_apps into etc/apps.

Hope this helps ...

cheers, MuS

Re: System-wide conf on Indexer Slaves

morethanyell — Wed, 30 Sep 2020 01:06:58 GMT

Does that mean if I create an app, let say called "system_wide_configs" and put web.conf in its /local directory, use the CM to distribute it to slave-apps, it will still work?

Theoretical Implementation:

Create system_wide_configs/local/web.conf
Put it in CM's ../etc/master-apps
apply cluster bundle
perform a rolling restart

it will then create ../etc/apps/slave-apps/system_wide_configs/local/web.conf to all the indexers, right?

Will Splunk be able to read it still?

Re: System-wide conf on Indexer Slaves

MuS — Thu, 27 Jun 2019 00:16:47 GMT

Yep, that's the way it works.

Either config files only in the master_apps/_cluster/local directory OR an app like you described it in master_apps/

cheers, MuS

Re: System-wide conf on Indexer Slaves

morethanyell — Thu, 27 Jun 2019 00:19:09 GMT

thank you. My thinking was right after all