Deployment Architecture

Importing .SPL project into Search head cluestering

dhawal_sanghvi
New Member

Hi Splunk Experts,
Need a clarrification - I have a .SPL file (contains artifacts, saved search, dashboards, macros, lookups,etc) extracted and exported from a stand alone search head (SH) box. Now, I want to import the file in to Search Head Clustering? Where should I load/import the .SPL file? Is it on the the deployer (OR) Captain (OR) Search Head Member (OR) Search Head Load Balancer so that the custom apps created are replicated on all the search head clustering? Please assist.

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

Hello dhawal_sanghvi,
will recommend to upload the file to the Deployer, that will untar the file and place the correct directories in .../etc/apps. make sure the app is working. Now just copy it from .../etc/apps to .../etc/shcluster/apps and deploy to Search Head Cluster Members
If the app has searches that runs against same indexers, will disable it on the Deployer after it works on Cluster Members to reduce load and avoid multiple alerts / scheduled searches / reports etc.
Hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

Hello dhawal_sanghvi,
will recommend to upload the file to the Deployer, that will untar the file and place the correct directories in .../etc/apps. make sure the app is working. Now just copy it from .../etc/apps to .../etc/shcluster/apps and deploy to Search Head Cluster Members
If the app has searches that runs against same indexers, will disable it on the Deployer after it works on Cluster Members to reduce load and avoid multiple alerts / scheduled searches / reports etc.
Hope it helps

0 Karma

adonio
Ultra Champion

Hello dhawal_sanghvi,
will recommend to upload the file to the Deployer, that will untar the file and place the correct directories in .../etc/apps. make sure the app is working. Now just copy it from .../etc/apps to .../etc/shcluster/apps and deploy to Search Head Cluster Members
Hope it helps

0 Karma

hardikJsheth
Motivator

I agree with @adonio

0 Karma

dhawal_sanghvi
New Member

Hi,
Just a follow up if I understood correctly

  1. Upload .spl file to the deployer from the web portal
  2. Verify the app is working.
  3. Then copy the data from .../etc/apps to .../etc/shcluster/apps in the deployer server
  4. Deploy to search head cluster members by running the command in the deployer server as ./splunk apply shcluster-bundle -target https://XXX.XX.XX.XXX:8089 -auth username:password
  5. Validate on the SHC members and the Splunk web if the app is shown.

Please correct!!

Thanks,
Dhawal

0 Karma

adonio
Ultra Champion

yes that is correct,
if your app has searches that runs against the indexers, disable the app on the deployer as a last step
if it works, please accept answer to close the question
cheers

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...