topic Re: Push configuration files in cluster in Deployment Architecture

Push configuration files in cluster

shangshin — Mon, 28 Sep 2020 14:14:42 GMT

Hi,
I have a splunk cluster and have config file props.conf and transforms.conf under master node $SPLUNK_HOME/etc/master-apps/_cluster/local/

I apply the change to its peers using CLI command apply cluster-bundle and I can see the new sourcetype is available on its peers. However, the fields in transforms.conf are not effective.

To veryify this transforms.conf is valid, I manually copy both config files to each peer /etc/system/local/ and it's working as expected.

Can any one shed some light on why transforms.conf is not working when pushed from the master node?

Thanks in advance!

Re: Push configuration files in cluster

ssankeneni — Wed, 03 Jul 2013 16:43:34 GMT

trying removing the files from /etc/system/local and push the files only from the master node. It might have conflict with the files in /etc/system/local

Re: Push configuration files in cluster

shangshin — Wed, 03 Jul 2013 16:49:38 GMT

Yes, I removed props.conf and transforms.conf from /etc/system/local/ but transforms.conf under /etc/slave-apps/_cluster/local/ still doesn't take any effect....

Re: Push configuration files in cluster

gkanapathy — Wed, 03 Jul 2013 19:32:54 GMT

Search-time fields should not be on indexers, only on the search head. Are your fields search-time extractions?

Re: Push configuration files in cluster

shangshin — Wed, 03 Jul 2013 19:40:17 GMT

Agree. If I place the transforms.conf in the search head, then I can see these fields from the search head. So if I want to see these fields on indexer, the only way is to place both config under /etc/system/local/ and it must be bundled with props.conf; otherwise, the fields won't be displayed on the UI. Is that correct?

Re: Push configuration files in cluster

gkanapathy — Wed, 03 Jul 2013 21:41:56 GMT

you should not need to put search-time extractions in the indexers into the indexer configuration. they are ignored. just put them on the search head. splunk will take care of it.