topic Re: How to apply replicationblacklist for a particular app in distsearch.conf? in Getting Data In

How to apply replicationblacklist for a particular app in distsearch.conf?

pavanae — Tue, 28 Jun 2022 01:32:24 GMT

On my replication bundle I have a whole list of unwanted files that exists from a particular App "XYZ" which are as shown below

apps/XYZ/bin/suds/mx/typer.pyc apps/XYZ/bin/suds/mx/encoded.py apps/XYZ/bin/suds/mx/__init__.pyc apps/XYZ/bin/suds/mx/literal.py apps/XYZ/bin/suds/mx/__init__.py apps/XYZ/bin/suds/options.py apps/XYZ/bin/suds/sudsobject.py

Now, how can i apply replicationblacklist to anything that is under the APP "XYZ" ?

distsearch.conf

[replicationBlacklist] ....

How to apply replicationblacklist for a particular app in distsearch.conf?

danielcj — Tue, 28 Jun 2022 06:06:33 GMT

Hello,

Please, try that:

[replicationBlacklist] block_suds_mx_files = apps/XYZ/bin/suds/mx/*.(py$|pyc$) block_suds_files = apps/XYZ/bin/suds/*.(py$|pyc$)

Re: How to apply replicationblacklist for a particular app in distsearch.conf?

VatsalJagani — Tue, 28 Jun 2022 06:28:29 GMT

Use [replicationDenylist] stanza instead, the above stanza you mentioned has been deprecated.

Re: How to apply replicationblacklist for a particular app in distsearch.conf?

Senak — Wed, 09 Nov 2022 16:04:13 GMT

Hello @VatsalJagani ,

Can this work for shcluster when i have my app in etc/shcluster/app ?

In other word can i blacklist an app located in etc/shcluster/app/?

It has to be done on the deployer right?

Thanks

Re: How to apply replicationblacklist for a particular app in distsearch.conf?

VatsalJagani — Wed, 09 Nov 2022 16:48:07 GMT

Yes, it will work.

How:

Replicate happens by the search head cluster captain.
Whatever you have under etc/shcluster/apps directory on the deployer will be moved to etc/apps directory on all the search heads including the captain.
Hence denylist should work as it would work on the standalone instance.

Re: How to apply replicationblacklist for a particular app in distsearch.conf?

Senak — Wed, 09 Nov 2022 17:20:19 GMT

Ok great, so now , that conf has to be made in etc/shcluster/apps/<my_app>/local/distsearch.conf?
Next does that mean the files blacklisted are not going to be in the bundle send to the sh members so not updated but they will not be deleted right?
My last question, is it possible to tell splunk to not update a whole app , instead of blacklisting files. My challenge is that i have space issue on the deployer when deploying a new app.

Any ideas

Thanks

Re: How to apply replicationblacklist for a particular app in distsearch.conf?

VatsalJagani — Wed, 09 Nov 2022 18:30:33 GMT

@Senak - Below are answers to your questions:

yes.
Splunk indexers (peers) will gonna use the latest bundle only. Now whether to send a full bundle or bundle delta that's up to Splunk. And it's not gonna affect how your files should behave.
Can you please explain how size is affecting what you need to push from the deployer?

Re: How to apply replicationblacklist for a particular app in distsearch.conf?

Senak — Thu, 10 Nov 2022 09:06:38 GMT

@VatsalJagani

This is the error i am dealing with when trying to push a new app on my SH cluster.

Error while creating deployable apps: Error compressing the temporary tarball: /opt/splunk/var/run/splunk/deploy.1805b9b8294a5b90.tmp/apps/SplunkEnterpriseSecuritySuite.bundle: No space left on device

It seems like Splunk Enterprise bundle is too big. How can i reduce it size or even prevent splunk to create a bundle for it?

Kind regards

Re: How to apply replicationblacklist for a particular app in distsearch.conf?

VatsalJagani — Thu, 10 Nov 2022 10:17:06 GMT

I would say create disk space on the deployer and SH for the bundle, that would be my advise.

Re: How to apply replicationblacklist for a particular app in distsearch.conf?

youngsuh — Tue, 30 May 2023 22:24:44 GMT

how do you validate that the setting is working? do you use BTOOL?