master-app and slaves-app

[vumanhtai]

Hi Splunk Team
When i used the app on peer node: App run corretly.
After I follow this guide to manage the app from master, it didnt run:
command used from master node: #/opt/splunk/bin/splunk apply cluster-bundle

https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/Updatepeerconfigurations

[DavidHourani]

Hi @vumanhtai,

You should not be installing apps directly on peer nodes in an IDX cluster. You should always go through the CM for app deployment.

Please confirm that your peer is connected to the master and make sure there is no connectivity issues :

 $SPLUNK_HOME/bin/splunk show cluster-status

Once you've confirmed that, you can then proceed with pushing the app from the CM using :

/opt/splunk/bin/splunk apply cluster-bundle

Make sure the app you wish to deploy is in the CM side is in the master-apps folders, and after deploying it should be in the salve-apps folder of your indexer.

Let me know how that works out for you.

Cheers,
David

[vumanhtai]

Hi DavidHourani
i see my app in folder slaves-app of peer node. but app not working

[DavidHourani]

Hi @vumanhtai,

This is good news, at least you know that deploying the app works.

Now questions are :
1- what is the app you are using ?
2- what is not working exactly ?
3- what do you have in your splunkd.log

[vumanhtai]

Hi DavidHourani
my app : website_monitoring
There is no log monitor for my websites

[DavidHourani]

what do you have in the app ? On the indexer you should have the indexes.conf configuration along with props.conf for any index time configs.

Once your index is created via this app, you can start sending logs to Splunk. Where are you sending the logs to ?

[vumanhtai]

this app when i install directly in the indexer, it run correcly and i see log monitor website
but when i push this app from master node to indexer , it not run and i don't see log monitor website

[DavidHourani]

weird, you're using the app from the indexer ? you should be going on the SH to "see" the app, am I misunderstanding something ? Could you please give me more details ?