topic Re: Moving searches from default to local to be able to manage on the cluster in Deployment Architecture

Moving searches from default to local to be able to manage on the cluster

skirven — Tue, 22 Sep 2020 09:49:14 GMT

Hi! I am trying to deal with some technical debt, and I thought I had an understanding of what I needed. 😞

Objective: I have some search artifacts inside a custom app on my Search Head Deployer that once deployed, users are unable to delete. On the Deployer, those searches were in the Default folder. I did give this what I thought was a thorough reading https://docs.splunk.com/Documentation/Splunk/7.2.10/DistSearch/PropagateSHCconfigurationchanges, but I may have missed something.

What I tried:
1) Backup the app
2) Moved the contents on the Deployer Server of shcluster/apps/app_name/default/savedsearches.conf to local/savedsearches.conf
3) I updated the local/app.conf to a "deployer_push_mode = full".

What appeared to happen: It seems that it may have merged the deployer local folder into the default on the cluster, which may make sense after another spin through the document.

What's the best approach for cleaning up this app? Should I just deploy it to my Search Head Deployer as an app, then remove the searches I want to clean up, then redeploy to the cluster?

Thanks!
Stephen

Re: Moving searches from default to local to be able to manage on the cluster

thambisetty — Tue, 22 Sep 2020 10:16:25 GMT

I believe you are looking something similar to below thread:

https://community.splunk.com/t5/Deployment-Architecture/Savedsearches-in-search-app-migrating-to-SHC/m-p/520776#M17915

Re: Moving searches from default to local to be able to manage on the cluster

skirven — Tue, 22 Sep 2020 10:21:29 GMT

Thanks for the response. But I already have the app created on the Deployer Server. It's moving the searches inside the app to be able to manage them. I don't want to go through and have to make a new app. 😞

Thanks!
Stephen