Deployment Architecture

About details of behavior on setting bundle from SH cluster

yutaka1005
Builder

In the following manual, when distributing the configuration file from the deployer, there is a describe that the local directory existing under the app of the SH cluster member will remain.

http://docs.splunk.com/Documentation/Splunk/6.5.5/DistSearch/PropagateSHCconfigurationchanges

The deployer never deploys files to the members' local app directories, $SPLUNK_HOME/etc/apps//local. Instead, it deploys both local and default settings from the configuration bundle to the members' default app directories, $SPLUNK_HOME/etc/apps//default. This ensures that deployed settings never overwrite local or replicated runtime settings on the members. Otherwise, for example, app upgrades would wipe out runtime changes.

However, as a result of setting bundle, the local directory existing under SH cluster member's apps disappeared.

If settings that is same with settings distributed by the setting bundle exists in the local directory of the SH cluster member, will it be deleted?

0 Karma
1 Solution

hardikJsheth
Motivator

@Yutaka,

When you push bundle from Search Head Deployer to search head cluster, it will overwrite default folder on the Search head with the content from Search Head Deployer but it will keep local folder as is.

If on your Search Head Deployer you have two folders within your app,
1. $SPLUNK_HOME/etc/shcluster/apps/ABC/deafault
2. $SPLUNK_HOME/etc/shcluster/apps/ABC/local.

Then, on pushing bundle to your search head nodes, Splunk will merge content of default and local folder on search head deployer and replace default folder on the Search head nodes with this new default folder. It also ensures to backup existing default folder by adding renaming the default folder with appending time stamp to it. On Search head nodes you will have following folders. The Splunk won't make any changes to the existing local folder on search head.

$SPLUNK_HOME/etc/apps/APC/default
$SPLUNK_HOME/etc/apps/APC/default.old.20160224-225042
$SPLUNK_HOME/etc/apps/APC/local

View solution in original post

0 Karma

hardikJsheth
Motivator

@Yutaka,

When you push bundle from Search Head Deployer to search head cluster, it will overwrite default folder on the Search head with the content from Search Head Deployer but it will keep local folder as is.

If on your Search Head Deployer you have two folders within your app,
1. $SPLUNK_HOME/etc/shcluster/apps/ABC/deafault
2. $SPLUNK_HOME/etc/shcluster/apps/ABC/local.

Then, on pushing bundle to your search head nodes, Splunk will merge content of default and local folder on search head deployer and replace default folder on the Search head nodes with this new default folder. It also ensures to backup existing default folder by adding renaming the default folder with appending time stamp to it. On Search head nodes you will have following folders. The Splunk won't make any changes to the existing local folder on search head.

$SPLUNK_HOME/etc/apps/APC/default
$SPLUNK_HOME/etc/apps/APC/default.old.20160224-225042
$SPLUNK_HOME/etc/apps/APC/local

0 Karma

yutaka1005
Builder

Thank you for answer!

I understood it.

As you said, almost app's local folder on search heads remained when I did "configuration-bundle" from deployer.
But one local folder was disappeared.(It is cause that I post this question)

It was on DBconnect ver3.x.x.
Then I read manual of DBconnect, and it showed that I shouldn't deploy DBconnect apps by using "configuration-bundle".

So I do not know the details, but I guess because of this specification of DB connect made a move different from the normal "configuration-bundle" movement.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...