Archive

Replicating/Copying files within Splunk SH Cluster members

ramesh_babu71
Path Finder

Hello,

We require your help implementing a part of solution for an app deployed in our Splunk SH cluster. The app is pushed to all the SH members using a deployer.

The App contains a script which downloads IoCs and deposits in the location “$SPLUNK_HOME/etc/apps/app_name/appserver/static“ so that our other Security solutions can access it via HTTP(S). The App is designed to download only in SH captain. This part works very well.

However we need a logic to copy/replicate the IOC files in /app_name/appserver/static (in captain) to other member servers too. The files in this location are CSV and JSON. Our goal is to access these files from remote location via web, If these files are kept updated in all peers then we can access it from any member server irrespective of which one is the actual captain node. Is there a way we can achieve this using Splunk only? We know this can be done using scp/share folder but client wants to do this within Splunk. Any help is appreciated.

0 Karma

nickhills
Ultra Champion

Are lookups not automatically synced between SH members? - Could you create you file in ./lookups?
http://docs.splunk.com/Documentation/Splunk/7.0.1/DistSearch/HowconfigurationworksinSHC

I think the fact that you are using app/static will prevent the run time replication - if you can move it to lookups, I think Splunk will handle it for you.

If my comment helps, please give it a thumbs up!
0 Karma

ramesh_babu71
Path Finder

Hi Nick,

We are keeping the files in the static folder so that these can accessed via http.

In our other security solutions we can just point the IOC location as http://splunkserver:8000/static/app/ app_name/IOCfilename.csv

If we move the files to lookups folder then we loose this facility.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!