All Apps and Add-ons

Is it possible to deploy Splunk dbconnect app through deployment server?

michaelrosello
Path Finder

Is it possible to deploy Splunk dbconnect app through deployment server?

I am facing an issue where splunk dbconnect app is installed in one of secured server(no copy/paste option). So it is a challenge to make changes because I need to type all the queries when creating an input.

Also there is no issue in connecting Deployment server and HF were db connect is installed.

0 Karma

nickhills
Ultra Champion

Possible - yes.
Advisable.....?

The reason I advise caution here, is that DBX makes use of checkpoints to keep track of datasources its retrieving.
If (for whatever reason) these checkpoints or the input definitions are lost/corrupted/updated you could end up with data duplication or loss.

One of the reasons for pushing apps via a DS is to ensure consistency, however since DBX can not be made HA/FT (presently) this benefit is limited.

Good practice also says that you should only make changes to an app or TA's /local path, but on DBX you have to drop libraries or support components into other locations, so already you would be deviating from recommendations.

Personally, for me DBX is a special case which gets installed locally even if other settings on the box are managed by a DS.

You could of course, push a secondary app which contains your input definitions.
This leaves the binary/config defined locally on the DBX server, and only your inputs managed by the DS - to me this seems far safer than managing the DBX app, though I have never actually tried this!

If my comment helps, please give it a thumbs up!
0 Karma

michaelrosello
Path Finder

You are correct with the potential issue with the checkpoints

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...