topic Re: deploy and configure apps to a cluster with heavy forwarders in Splunk Search

deploy and configure apps to a cluster with heavy forwarders

sam1010 — Mon, 09 Aug 2021 05:37:09 GMT

Can anyone tell me the steps to deploy and configure multiple apps in a cluster with heavy forwarders.

Re: deploy and configure apps to a cluster with heavy forwarders

manjunathmeti — Mon, 09 Aug 2021 07:21:46 GMT

1. Deploy search head apps from the Deployer server to Search Heads in the cluster.

2. Deploy indexer apps from Cluster Master server to Indexer Servers/Peers in the cluster.

3. Deploy heavy forwarder apps from Deployment server to Heavy Forwarders.

Re: deploy and configure apps to a cluster with heavy forwarders

gcusello — Mon, 09 Aug 2021 07:45:24 GMT

Hi @sam1010,

as @manjunathmeti said, on a Search Hards Cluster you can use only Deployer to deploy apps.

The steps to follow are at https://docs.splunk.com/Documentation/Splunk/8.2.1/DistSearch/PropagateSHCconfigurationchanges

in few words:

copy your unzipepd apps on Deployer $SPLUNK_HOME/etc/shcluste/apps,
flom CLI, run the command

splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

beware: if your apps are already installed on the SHC, the above command overrides lookups, if you don't want to override lookups, you have to use:

splunk apply shcluster-bundle -target <URI>:<management_port> -preserve-lookups true -auth <username>:<password>

On Heavy Forwarders, as @manjunathmeti said, you can use the Deployment Server.

The steps are described at https://docs.splunk.com/Documentation/Splunk/8.2.1/Updating/Updateconfigurations

in few words:

copy your unzipped apps at $SPLUNK_HOME/etc/deployment-apps
wait few minutes or run

splunk reload deploy-server

Only one attention point: if you have two or more HF to take syslogs with a front Load Balancer, in this way there could be the risk that both the HFs restart at the same time, so you lose syslogs, in this case I hint to manually install apps one HF after the other.

Ciao.

Giuseppe

Re: deploy and configure apps to a cluster with heavy forwarders

sam1010 — Mon, 09 Aug 2021 18:47:06 GMT

@gcusello Thanks for the solution and providing relevant documentation. Is there any documentation for @manjunathmeti 's answers 2nd step as well? i.e. " 2. Deploy indexer apps from Cluster Master server to Indexer Servers/Peers in the cluster." In other words how do I carry out this step about deploying apps in indexer?

Re: deploy and configure apps to a cluster with heavy forwarders

manjunathmeti — Tue, 10 Aug 2021 02:01:39 GMT

To deploy indexer apps from cluster master:

copy your unzipped apps on cluster master $SPLUNK_HOME/etc/master-apps
from CLI, run the command

/opt/splunk/bin/splunk apply cluster-bundle --answer-yes -auth <username>:<password>

Once the latest bundle is deployed, apps will be stored in $SPLUNK_HOME/etc/slave-apps on indexer servers.

Re: deploy and configure apps to a cluster with heavy forwarders

gcusello — Tue, 10 Aug 2021 07:31:16 GMT

Hi @sam1010,

Google is your best friend for searching documentation, anyway, you can find the documentation about Indexers Cluster at https://docs.splunk.com/Documentation/Splunk/8.2.1/Indexer/Manageappdeployment and at https://docs.splunk.com/Documentation/Splunk/8.2.1/Indexer/Updatepeerconfigurations

In few words, you have to:

by CLI copy your unzipped apps in $SPLUNK_HOME/etc/master-apps,
by GUI push the configurations.

Ciao and happy splunking.

Giuseppe