How to remove Search Head apps from Deployment server safely

[spl_unker]

Hi ,

In our existing  Splunk environment we are mananging  all the UF , indexer and Search head apps in one deployment server which caused issue in the knowledge objects that was created over the Search Head.  Whenever there is a refresh . It rolls back to older changes

Now we want to manage the search head apps from Deployer instead of Deployment server.

In this process , how to to safely remove the server class that was created for SH apps in deployment server. On doing so will it delete the apps in Search head?

Thanks 

[spl_unker]

Hi @gcusello  thanks for your time. I dont want apps to be removed from SH . Instead is there a  way to just disable the server class or what happens if i remove the client(SH) form the server class? 

[gcusello]

Hi @spl_unker,,

if you remove the client from the ServerClass Apps will be remeoved.

probably you could maintain apps pn SHs disabling the connection with Deployment Server, removing deploymentclients.conf from SHs, but I never tried this operation.

Ciao.

Giuseppe

[gcusello]

Hi @spl_unker,

managing Search Heads and Indexers with Deployment Server isn't a good idea, as you experimented!

Anyway, you can manage Search Heads using Deployer only if you have a Search Head Cluster, are your SHs clustered?

In addition, to have a SH-Cluster you need at least three SHs, how many SHs do you have in your architecture?

Coming back to your question, you can remove SHs from the related ServerClass and all the apps will be removed by SHs, then you can configure SH-Cluster with Deployer and deploy the Apps or install your app manually.

Having a SH-Cluster has many additional advantages:

• when lookups are updated on one SH, updates will be replicated on the other SHs,
• idem changes on apps,
• Alerts will be distributed between members and execute only one time,
• etc...

Ciao.

Giuseppe