All Apps and Add-ons

After migrating from a standalone search head to a search head cluster, why is the search_migrated app showing up as the Website Monitoring app?

New Member

We have migrated our settings from a standalone Splunk search head (views, users, etc) to a search head cluster. We copied search to search_migrated app and did export=system in metadata/local.meta.

Our problem is that we need the searchmigrated app to remain visible so that the views are also visible. In that regard, everything is working as expected. The issue arises when we try to do a search from the searchmigrated app. The header is replaced by the "Website monitoring" app's header, and if we select "search_migrated" from the app drop-down it just brings us to the Website Monitoring app.

Is there a way to separate the function of these two apps?

0 Karma

Path Finder

Hi Tedd4vis-

This is what we did. YMMV.

We tested the SHC and Indexer clustering with this app. What I found was to spin up a separate SH instance that was standalone and use it as an app server. We installed the Website_monitoring app there and configured an app to forward all data to our Relay Forwarders. What happens then is that all configuration of the app happens only on that standalone SH. It then replicates out to all of the other SH's in the cluster. You will be able to create dashboards for this app on all of the SH's. If you want to use a new index for this, make sure you create it before you install (or in your case, reinstall) the app, as the data flow is one-way from standalone SH to the cluster.

You should seriously just consider reinstalling the app, unless you already have hundreds of websites in there.

Hope this helps,
Mike B.

0 Karma

SplunkTrust
SplunkTrust

It looks like you have copied all files from Website Monitoring App to search_migrated app except the apps.conf.

On the disk , just verify the contents of folders of Website Monitoring App and search_migrated and re-arrange the files to respective folders.

Files will be under $SPLUNK_HOME/etc/apps/

New Member

The files in websitemonitoring and searchmigrated are entirely different. The only files that are similar are /metadata/local.conf because they both have export=system under the [] stanza.

I think there is something else going wrong with how the apps are discovered by splunk.

0 Karma