Update apps in Search Heads from deployer

[Jhojan]

Hello,

Last week I've been trying to implement a JS script in a distributed environment, and while it worked fine in a single machine, the replication has not been made in all of the SH.

The question is: How can I deploy the changes made alongside the SH ? , already tried to use the command: splunk reload deploy-server

and while it didn't return any error message, the changes were not made. As a workaround I've tried to apply the changes in a SH then wait for it to replicate in the others, which seemingly worked fine. Still, isn't there a way (like the command listed before) to force changes among the SH ?

Thanks in advance.

[isoutamo]

Have you individual SH's which you are managing by Deployment Server or have you a SH Cluster with Deployer?

[manjunathmeti]

You need to push updated apps from the deployer server to all the search heads in the cluster.

If you make a change on one of the search head and it is replicated to other search heads then you don't need to push the apps but if not replicated then you need to copy changes (app directory) from that search head server($SPLUNK_HOME/etc/shcluster/apps/<app>/)) to the deployer server (in $SPLUNK_HOME/etc/apps/<app>/) and push to all search heads.

Check this: https://docs.splunk.com/Documentation/Splunk/8.1.2/DistSearch/PropagateSHCconfigurationchanges

[gcusello]

Hi @Jhojan,

the command "splunk reload deploy-server" isn't for Deployer but ony for Deployment Server.

if you have to deploy a configuration from Deployr to Search Heads in Cluster you have to use the command

splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

described at https://docs.splunk.com/Documentation/Splunk/8.1.2/DistSearch/PropagateSHCconfigurationchanges#Push_...

or, preserving lookups:

splunk apply shcluster-bundle -target <URI>:<management_port> -preserve-lookups true -auth <username>:<password>

Ciao.

Giuseppe