Cleanest Way of Updating Splunk Search Head Addon/Apps without Losing Local Changes and Configurations

[NightShark]

When upgrading apps/add-ons in a distributed environment, is there a recommended best practice or is it similar to deploying the app initially where I can just paste the newer downloaded version from Splunkbase over the existing app and then push the new bundle to the peers to fully update the app? ex. having version 1 and 2 in the same shcluster/apps directory, will the latest version take priority over the older while also benefitting from the configurations made in the previous version?

Search Head Local changes to not appear to be visible in the deployer server, so do I have to also include the local directory of the related app from the search heads and include it inside the newly updated app before pushing through deployer? 

PS: App I am trying to update is ES Content Update

Or maybe there is a spesific push command to preserve local changes?

Any and all help is welcome, thanks in advance!

[isoutamo · Accepted solution]

Hi

You should read apps' README / INSTALL etc. documentation to check if there are any special comments/instructions to you. In general case you should just update app via Deployer to SHC. Just untar that package over previous version into .../etc/shcluster/apps/<app name>. Of course if you have done your own changes here over default instead of local directory then you must manually merge those changes to the new version, otherwise you will lost (at least partially) your current changes. If users have done local modifications directly to SHC nodes then it depends on your push mode what will happen. In normal case those will be there after update. You should read more from here https://docs.splunk.com/Documentation/Splunk/8.2.4/DistSearch/PropagateSHCconfigurationchanges#Choos...

r. Ismo

[NightShark]

That is my only method of updating the apps in the SHC in order to keep equilibrium throughout the enviroment is using a deployer.

My push mode is usually as follows:

splunk apply shcluster-bundle -target https://SH_I :8089

Which I assume is the default "merge to default" mode that does not interfere with any of the local changes made and or configurations made on every individual search head node correct?

Thank you very much for your response,

[isoutamo]

That’s correct