All Apps and Add-ons

After migrating from a standalone search head to a search head cluster, why is the search_migrated app showing up as the Website Monitoring app?

tedd4vis
New Member

We have migrated our settings from a standalone Splunk search head (views, users, etc) to a search head cluster. We copied search to search_migrated app and did export=system in metadata/local.meta.

Our problem is that we need the search_migrated app to remain visible so that the views are also visible. In that regard, everything is working as expected. The issue arises when we try to do a search from the search_migrated app. The header is replaced by the "Website monitoring" app's header, and if we select "search_migrated" from the app drop-down it just brings us to the Website Monitoring app.

Is there a way to separate the function of these two apps?

0 Karma

atari1050
Path Finder

Hi Tedd4vis-

This is what we did. YMMV.

We tested the SHC and Indexer clustering with this app. What I found was to spin up a separate SH instance that was standalone and use it as an app server. We installed the Website_monitoring app there and configured an app to forward all data to our Relay Forwarders. What happens then is that all configuration of the app happens only on that standalone SH. It then replicates out to all of the other SH's in the cluster. You will be able to create dashboards for this app on all of the SH's. If you want to use a new index for this, make sure you create it before you install (or in your case, reinstall) the app, as the data flow is one-way from standalone SH to the cluster.

You should seriously just consider reinstalling the app, unless you already have hundreds of websites in there.

Hope this helps,
Mike B.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

It looks like you have copied all files from Website Monitoring App to search_migrated app except the apps.conf.

On the disk , just verify the contents of folders of Website Monitoring App and search_migrated and re-arrange the files to respective folders.

Files will be under $SPLUNK_HOME/etc/apps/

tedd4vis
New Member

The files in website_monitoring and search_migrated are entirely different. The only files that are similar are /metadata/local.conf because they both have export=system under the [] stanza.

I think there is something else going wrong with how the apps are discovered by splunk.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!