All Apps and Add-ons

After migrating from a standalone search head to a search head cluster, why is the search_migrated app showing up as the Website Monitoring app?

tedd4vis
New Member

We have migrated our settings from a standalone Splunk search head (views, users, etc) to a search head cluster. We copied search to search_migrated app and did export=system in metadata/local.meta.

Our problem is that we need the search_migrated app to remain visible so that the views are also visible. In that regard, everything is working as expected. The issue arises when we try to do a search from the search_migrated app. The header is replaced by the "Website monitoring" app's header, and if we select "search_migrated" from the app drop-down it just brings us to the Website Monitoring app.

Is there a way to separate the function of these two apps?

0 Karma

atari1050
Path Finder

Hi Tedd4vis-

This is what we did. YMMV.

We tested the SHC and Indexer clustering with this app. What I found was to spin up a separate SH instance that was standalone and use it as an app server. We installed the Website_monitoring app there and configured an app to forward all data to our Relay Forwarders. What happens then is that all configuration of the app happens only on that standalone SH. It then replicates out to all of the other SH's in the cluster. You will be able to create dashboards for this app on all of the SH's. If you want to use a new index for this, make sure you create it before you install (or in your case, reinstall) the app, as the data flow is one-way from standalone SH to the cluster.

You should seriously just consider reinstalling the app, unless you already have hundreds of websites in there.

Hope this helps,
Mike B.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

It looks like you have copied all files from Website Monitoring App to search_migrated app except the apps.conf.

On the disk , just verify the contents of folders of Website Monitoring App and search_migrated and re-arrange the files to respective folders.

Files will be under $SPLUNK_HOME/etc/apps/

Happy Splunking!

tedd4vis
New Member

The files in website_monitoring and search_migrated are entirely different. The only files that are similar are /metadata/local.conf because they both have export=system under the [] stanza.

I think there is something else going wrong with how the apps are discovered by splunk.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...