topic Re: Why does running btool on my Deployer not output authentication config files for a search head cluster? in Deployment Architecture

Why does running btool on my Deployer not output authentication config files for a search head cluster?

Thuan — Thu, 03 Mar 2016 21:24:43 GMT

I was in the process of identifying all the authentication config files on my Deployer in a search head cluster environment. The intent is find out all the files that are listed under $SPLUNK_HOME/etc/shcluster/apps/ as they relate to authentication settings on the remote systems.

I did:

$SPLUNK_HOME//bin/splunk btool authentication list --debug

The output listing did NOT show anything about $SPLUNK_HOME/etc/shcluster/apps/
This subdirectory does exist however and shows up using a regular "ls".
Have I missed anything about btool?

Re: Why does running btool on my Deployer not output authentication config files for a search head cluster?

lguinn2 — Thu, 03 Mar 2016 23:39:16 GMT

btool consolidates the on-disk configuration settings for a Splunk instance and then displays them. You are running btool on the deployer, but the configuration files of interest are not the settings for the deployer - etc/shcluster does not apply to the deployer. So btool does not consider those settings.

etc/shcluster is just a repository for configurations. The same is true for etc/deployment-apps on a deployment server and etc/master-apps on a cluster master. None of these directories will be examined by btool.

To see the authentication settings, you need to go to a Splunk instance where those settings are active - in other words, on one of the clustered search heads.

Re: Why does running btool on my Deployer not output authentication config files for a search head cluster?

somesoni2 — Thu, 03 Mar 2016 23:42:26 GMT

The btool utility will provide the effective Splunk configuration (taking into account configuration file layering and user/app context) for the Splunk instance where the utility was run. The files that are effective in a Splunk instance are located in etc/system (default and local) and etc/apps/AppName (default and local). The configuration in etc/shcluster/apps (and etc/deployment-apps) are just app repository and they are applied on the system(s) receiving it, which will be Search Heads. So, if you want to inquire what authentication applied on your SH Cluster, then run the btool from one of the SH Cluster member.

Re: Why does running btool on my Deployer not output authentication config files for a search head cluster?

Thuan — Mon, 07 Mar 2016 14:45:17 GMT

This helps me to understand why /etc/shcluster is not included in btool.
Thank you for the clarification.