I inherited a Splunk installation and I'm a little confused about the app directories in $SPLUNK_HOME/etc (I'm sure its probably answered in docs.splunk.com, and I've looked but I can't seem to find where this might be documented)
(1) I have both a standalone Splunk installation and an installation with a cluster manager. In each installation there is an "apps", "deployment-apps", "master-apps" and "system" directory in $SPLUNK_HOME/etc. When would I use each specific directory?
(2) Within "apps", "deployment-apps", and "master-apps", there are directories (that have the standard default/local/metadata subdirectories) called IA-appname and TA-appname where appname is something like "shibboleth" for data forwarded from Shibboleth servers. What goes in the IA dirs and what goes in the TA dirs?
(3) Is there a way (either CLI or Web GUI) to determine if the changes I've made or IA/TA subdirectories I've created have been incorporated into the Splunk configuration?
Thanks for any help/suggestions/links you can offer.
Because the Splunk Enterprise software package contains the Indexer, the Search Head, the Deployment Server, the Deployer and more, it gets tricky.
Therefore, it depends on the context - on the Deployment Server
$SPLUNK_HOME/etc/deployment-apps contains all the apps to be distributed to the forwarders. On the Deployer Server, in a cluster,
$SPLUNK_HOME/etc/shcluster/apps holds the apps to be distributed to the Search Heads. On the Search Head,
$SPLUNK_HOME/etc/apps holds the apps themselves.
$SPLUNK_HOME/etc/master-apps is to distribute apps to the indexers - Manage app deployment across all peers