Hi, I have recently installed a Splunk cluster. My configuration is supposed to be 1 Master(also the licensing master) , 3 indexer peers, *1 search head : indexing turned off *. I have created a basic configuration bundle - a folder for myapp1 under in master-apps on the master node:
$SPLUNK_HOME/etc/master-apps/
_cluster/
default/
local/
indexes.conf
validated the bundle and on success applied to cluster. This created the index and app on the indexers. I had to make the app visible on the indexers however I don't see the app on the search head. How do I make sure the app is visible to users who will only login to the search head. is there another procedure for this? Please help.
Thanks,
Nelton
To manually deploy the app to the search head, tar it back up like this:
cd $SPLUNK_HOME/master-apps
tar czvf SendMeToSearchHead.tgz ./YourAppDirNameHere
Then use whatever tool that you like to transfer it to your Search Head into $SPLUNK_HOME/apps
and do this
tar xvf ./SendMeToSearchHead.tgz
rm -f ./SendMeToSearchHead.tgz
However, it is uncommon for any app with is_visible
to be appropriate for both your Search Head and Indexer tier. I would stop and make absolutely sure that this is what you should be doing.
Thanks a lot for your reply. If I package the app folder under master-apps on the master node. But this folder only has the indexes.conf and not the app.conf. is that ok?
Yes, it is VERY common to deploy an indexes.conf
app via master-apps
to the slaves. It should have an app.conf
but isn't necessary. You need the indexes.conf
app on your Search Head, too, otherwise you will not be able to limit certain people/roles to certain index values because the Search Head will not know about all index values.
And also I have disabled indexing on my search head, but the packaged app file will have the indexes.conf; will this be ignored?
See combined comment above.
How can I deploy the app that I created manually with an index to the standalone search head? is it possible that the app and the associated indexes be visible to the user on the search head? I am a bit confused after reading about deployer component of splunk. Should I be packaging the app to deploy to search head or use the deployer?
Hello there,
the Cluster Master distributes apps only to its Cluster Peers (Indexers) to their .../etc/slave-apps/ directory.
it does not distribute any configuration to the Search Peers (Search Heads)
you can add an app manually to the Search Head, or use a Deployment Server.
Hope it helps
Hi neltonk,
Master Node manages only Indexers, not Search Heads (see http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Clusterdeploymentoverview ).
You correctly deployed App to indexers using Master Node but you have to manually install app on the Search Head.
Bye.
Giuseppe
Hi
How to deploy apps on Search Head manually ?
Thanks
Hi neltonk,
you can pack your app (see http://dev.splunk.com/view/webframework-developapps/SP-CAAAEMY ) and then install it using the web interface [Apps -- Manage Apps -- Install App from file].
Otherwise (if you can restart your Search Head it's easier!) you can unpack your App in your PC (if packed) and then copy your unpacked app in $SPLUNK_HOME/etc/apps and then restart Splunk (see https://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall ).
Bye.
Giuseppe
Deployer is used only in Search Head Clusters, not in stand alone SH.
In this case, you have to copy App in SH and restart Splunk.
How do you configured Your SH? Did you used the cluster instructions?
Bye.
Giuseppe
Thanks a lot for all your patient replies
It is standalone implementation. I only configured the clustering for indexers according to splunk documentation. I have packaged the app folder from the indexer node and deployed to the SH but this only has app.conf . I restarted splunk on SH and the app is visible.
Is this correct?
or should I package the app folder under master-apps on the master node(as Woodcock suggested). But this folder only has the indexes.conf and not the app.conf
Hi neltonk,,
You can use Master Node ONLY to deploy Apps to Indexers, not to other systems as Search Heads.
On stand alone Search Heads you can only manually install apps (really you could use a Deployment Server but it's mad!)
Let me know your architecture:
If you want to use an App on a Search Head configured to see the data on Indexers Cluster, you have at first to configure SH following the procedure described at http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Configurethesearchhead .
Then you have to manually copy your custom App on SH (using tar or any other way) at $SPLUNK_HOME/etc/apps and then restart Splunk.
In this way you have:
At the end, I don't understand what you mean saying: "I have packaged the app folder from the indexer node and deployed to the SH but this only has app.conf" because you cannot deploy an app to a stand alone SH from an indexer.
Bye.
Giuseppe
Hi Giuseppe,
Thanks for the quick reply. How can I deploy the app that I created manually to the standalone search head? Will the app and the associated indexes be visible to the user on the search head?
regards,
Nelton