Splunk Enterprise

How to Deploy ui-pref.conf in Search Head Cluster using Deployer?

sat94541
Communicator

We have need to set ui preference with default time range picker globally across of the searches run in Splunk. We need to deploy these configuration across all three search Head Cluster Member in SHCM (search Head Cluster Memeber Pool)

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Deployed application named "search_head_pushed_config" from deployer to Search head Cluster members.
The app has the following configuration was specified in ui-prefs.conf :
[default]
dispatch.earliest_time = -15m
dispatch.latest_time = now
display.prefs.enableMetaData=0
display.prefs.showDataSummary=0

The config was pushed to the search cluster.

Note : Also for the App, “search_head_pushed_config” enabled settings for exporting globally by defining folloing, If not, its ui-prefs.conf will not be visible to other apps, which will prevent the timepicker customizations from applying in other app contexts.

$SPLUNK_HOME/etc/shcluster/apps/search_head_pushed_config/metadata
[]
Export=system

This behavior is similar to non -cluster Search head.


cramasta
Builder

So when you say to put these setting in $SPLUNK_HOME/etc/shcluster/apps/search_head_pushed_config/metadata Im guessing you mean the default.meta file?

What would happen over the course of time if I start adding new knowledge objects to the search_head_pushed_config app from the Splunk UI which creates a local.meta file, and then one day i push a update to this app from the deployer, will it delete my local.meta file since my deployer metadata folder only contains the default.meta? Im just now setting up my Search Head Cluster and still reading the docs but I haven't yet read anything that talks about how the metadata folder is handled if its managed by the deployer. The topics that are stressed that i read so far is what happens with the default and local directories.

Thanks,
J

0 Karma

Lucas_K
Motivator

Local search head ui modified local.meta is immune to deployer based changes.

Deployer merges all "local" based configurations into defaults. This includes local.meta which will be merged with default.meta.

It's best to try and have just the one meta file regardless so it is perfectly clear what the detault.meta will be when it is deployed to members.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...