topic Re: Slave apps vs deployment apps in Deployment Architecture

Slave apps vs deployment apps

gschmitz — Tue, 26 Mar 2013 05:58:23 GMT

Hi,
since index replication we have got another way to distribute configuration. I already found out by troubleshooting that any index definition in _cluster overrules my deployment apps.
Furthermore deploying via the cluster gracefully restarts splunkd.

So my question is: what are the best practices?

Re: Slave apps vs deployment apps

Steve_G_ — Wed, 03 Apr 2013 19:09:34 GMT

If you're deploying apps to the peer nodes on a cluster, you must use this method:

http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Updatepeerconfigurations

This puts the apps under $SPLUNK_HOME/etc/slave-apps

Configuration file precedence rules are here:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles

For a quick summary, see this subsection of that topic:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles#Summary_of_directory_precedence

Re: Slave apps vs deployment apps

jkat54 — Mon, 02 Nov 2015 21:54:07 GMT

It's not that you "must use this method", its that you can use this method and if you want to,... here's how you do it... but beware that the cluster bundle will supersede any configurations you send via deployment servers.

http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Updatepeerconfigurations

right???

Re: Slave apps vs deployment apps

esix_splunk — Tue, 03 Nov 2015 01:55:46 GMT

It's against best practices to use a deployment server to push apps to indexers. Mainly because it doesnt gracefully restart the indexer. That being said, it can be done but with caution.

Best practices is to use the Cluster Master's slave-apps to deploy to your indexers. This keeps parity among the indexers and cluster master and can reduce load on the cluster that would be associated to peers that dont cleanly restart.

Re: Slave apps vs deployment apps

Steve_G_ — Tue, 03 Nov 2015 03:11:53 GMT

The configuration bundle method is the only way to ensure that certain key configurations stay in sync across all peer nodes, which is necessary for the proper operation of the cluster.

Regarding use of deployment server or third-party tools:

http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Keydifferences#Do_not_use_deployment_server_or_third-party_deployment_tools_with_cluster_peers