Dashboards & Visualizations

How to remove Search Head apps from Deployment server safely

spl_unker
Explorer

Hi ,

In our existing  Splunk environment we are mananging  all the UF , indexer and Search head apps in one deployment server which caused issue in the knowledge objects that was created over the Search Head.  Whenever there is a refresh . It rolls back to older changes

Now we want to manage the search head apps from Deployer instead of Deployment server.

In this process , how to to safely remove the server class that was created for SH apps in deployment server. On doing so will it delete the apps in Search head?

 

Thanks 

Labels (1)
Tags (1)
0 Karma

spl_unker
Explorer

Hi @gcusello  thanks for your time. I dont want apps to be removed from SH . Instead is there a  way to just disable the server class or what happens if i remove the client(SH) form the server class? 

0 Karma

gcusello
Esteemed Legend

Hi @spl_unker,,

if you remove the client from the ServerClass Apps will be remeoved.

probably you could maintain apps pn SHs disabling the connection with Deployment Server, removing deploymentclients.conf from SHs, but I never tried this operation.

Ciao.

Giuseppe

0 Karma

gcusello
Esteemed Legend

Hi @spl_unker,

managing Search Heads and Indexers with Deployment Server isn't a good idea, as you experimented!

Anyway, you can manage Search Heads using Deployer only if you have a Search Head Cluster, are your SHs clustered?

In addition, to have a SH-Cluster you need at least three SHs, how many SHs do you have in your architecture?

Coming back to your question, you can remove SHs from the related ServerClass and all the apps will be removed by SHs, then you can configure SH-Cluster with Deployer and deploy the Apps or install your app manually.

Having a SH-Cluster has many additional advantages:

  • when lookups are updated on one SH, updates will be replicated on the other SHs,
  • idem changes on apps,
  • Alerts will be distributed between members and execute only one time,
  • etc...

Ciao.

Giuseppe

 

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...