All Apps and Add-ons

Best Pratice to upgrade app in distributed env ? Also seeing "no inputs exist" message on search head despite inputs existing

Esky73
Builder

I have tried an upgrade in our test env (standalone SH & standalone HF - internet facing) by doing the following :

-Backed up existing website_monitoring dir (1.5.0)
-On HF - Extracted 1.6.1 tar file over existing dir - checked local dir and the inputs.conf still had the URL configs.
Restart
-Repeat on SH restart.

Looks ok - can see the URL's in the status view - added a new input on the HF

We have a message on the search head where it says its still looking for inputs :

alt text

With regards to pushing this out on the Prod env (3 x SH's)

Use the same method for the Internet facing HF and for the SHC copy the tar to the ../shcluster/apps/website_monitoring folder and deploy ?

Cheers.

0 Karma
1 Solution

LukeMurphey
Champion

This sounds like a bug in how inputs are detected in the Website Monitoring app (it doesn't detect them correctly on an SHC environment). I opened a ticket on it: http://lukemurphey.net/issues/1461.

The fix is planned for 1.6.2.

Update:

Version 1.6.2 has been released with a fix for this.

View solution in original post

Esky73
Builder

Hi I have some other questions with regards to inputs.

I have tried a few test URLs - now if i add a URL using settings > data inputs > website availability check - the config is written to the ../local/inputs.conf file.

But if i try and use the new "create inputs" tab on the dashboard\homepage then where does it write this config as nothing is written to the ../local/inputs.conf using this method although the URL is added to the list and polled.

Also i cannot see how to remove a URL entered using this method ?

Thanks.

0 Karma

Esky73
Builder

OK if you use that method then the file is placed :

$SPLUNK_HOME/etc/apps/search/local/inputs.conf

0 Karma

LukeMurphey
Champion

This sounds like a bug in how inputs are detected in the Website Monitoring app (it doesn't detect them correctly on an SHC environment). I opened a ticket on it: http://lukemurphey.net/issues/1461.

The fix is planned for 1.6.2.

Update:

Version 1.6.2 has been released with a fix for this.

LukeMurphey
Champion

Are you saying that everything is working with the exception of that message?

0 Karma

Esky73
Builder

Yep apart from that - it all seems to be working fine, thx

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...