topic Re: Importing .SPL project into Search head cluestering in Deployment Architecture

Importing .SPL project into Search head cluestering

dhawal_sanghvi — Thu, 30 Mar 2017 11:15:03 GMT

Hi Splunk Experts,
Need a clarrification - I have a .SPL file (contains artifacts, saved search, dashboards, macros, lookups,etc) extracted and exported from a stand alone search head (SH) box. Now, I want to import the file in to Search Head Clustering? Where should I load/import the .SPL file? Is it on the the deployer (OR) Captain (OR) Search Head Member (OR) Search Head Load Balancer so that the custom apps created are replicated on all the search head clustering? Please assist.

Re: Importing .SPL project into Search head cluestering

adonio — Thu, 30 Mar 2017 13:09:47 GMT

Re: Importing .SPL project into Search head cluestering

hardikJsheth — Thu, 30 Mar 2017 13:51:35 GMT

I agree with @adonio

Re: Importing .SPL project into Search head cluestering

adonio — Thu, 30 Mar 2017 13:54:58 GMT

Hello dhawal_sanghvi,
will recommend to upload the file to the Deployer, that will untar the file and place the correct directories in .../etc/apps. make sure the app is working. Now just copy it from .../etc/apps to .../etc/shcluster/apps and deploy to Search Head Cluster Members
If the app has searches that runs against same indexers, will disable it on the Deployer after it works on Cluster Members to reduce load and avoid multiple alerts / scheduled searches / reports etc.
Hope it helps

Re: Importing .SPL project into Search head cluestering

dhawal_sanghvi — Thu, 30 Mar 2017 14:13:33 GMT

Hi,
Just a follow up if I understood correctly

Upload .spl file to the deployer from the web portal
Verify the app is working.
Then copy the data from .../etc/apps to .../etc/shcluster/apps in the deployer server
Deploy to search head cluster members by running the command in the deployer server as ./splunk apply shcluster-bundle -target https://XXX.XX.XX.XXX:8089 -auth username:password
Validate on the SHC members and the Splunk web if the app is shown.

Please correct!!

Thanks,
Dhawal

Re: Importing .SPL project into Search head cluestering

adonio — Thu, 30 Mar 2017 14:24:45 GMT

yes that is correct,
if your app has searches that runs against the indexers, disable the app on the deployer as a last step
if it works, please accept answer to close the question
cheers