- Splunk Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Re: Saved search changes in search head cluster do...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Saved search changes in search head cluster don't persist.
We have some scheduled saved searches that we migrated from a stand-alone SH to a SHC via a deployer. When we try and edit a search (in this case the edit is removing an email address), then save the change, the change doesn't persist. Is this because the edit is removing something and so savedsearches.conf in /local is not being updated?
We can create a new search and edit it ok, it's just the searches that were deployed that are the issue. Would like to know if this is expected functionality or a bug.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you saying you have moved searches from the local search head (previously a single instance) to a deployer and pushed them to a search head cluster?
In this case searches pushed by the deployer cannot be deleted on the search head cluster, I'm unsure why editing does not work in your scenario but my solution was to clone any searches pushed by the deployer so they existed locally on the search head and to stop them from been pushed by the deployer itself. This was a pain but something that had to be fixed eventually...
Just to confirm, when you edit the search your saying the local/savedsearches.conf doesn't get created if it was pushed by the deployer?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Okay, so this link describes what is happening
This link describes where to put the modified saved search so that it will be propagated correctly. See the section under "Where to place the configuration bundle on the deployer"
http://docs.splunk.com/Documentation/Splunk/6.5.3/DistSearch/PropagateSHCconfigurationchanges
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Where, precisely, are you editing the search? It is not likely to be the type of change that you are making, it is likely to be where you are making the change.
You need to edit it and deploy the update, not edit it on any SH. Otherwise, the deployer will just have to overwrite that pesky search that is getting out of sync with its master.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The change being made is via Splunk web. In this sceanrio the user is trying to remove an email address that was part of the deployed saved search. Hope this makes it clear.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
PS, we are using Splunk Enterprise 6.5.2
Splunk Custom Visualizations App End of Life
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
