Deployment Architecture
Highlighted

App created in Master and deployed to indexers not visible in searchhead

Path Finder

Hi, I have recently installed a Splunk cluster. My configuration is supposed to be 1 Master(also the licensing master) , 3 indexer peers, *1 search head : indexing turned off *. I have created a basic configuration bundle - a folder for myapp1 under in master-apps on the master node:
$SPLUNK_HOME/etc/master-apps/
_cluster/
default/
local/
/
indexes.conf

validated the bundle and on success applied to cluster. This created the index and app on the indexers. I had to make the app visible on the indexers however I don't see the app on the search head. How do I make sure the app is visible to users who will only login to the search head. is there another procedure for this? Please help.

Thanks,
Nelton

Highlighted

Re: App created in Master and deployed to indexers not visible in searchhead

Legend

Hi neltonk,
Master Node manages only Indexers, not Search Heads (see http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Clusterdeploymentoverview ).
You correctly deployed App to indexers using Master Node but you have to manually install app on the Search Head.
Bye.
Giuseppe

0 Karma
Highlighted

Re: App created in Master and deployed to indexers not visible in searchhead

Explorer

Hi

How to deploy apps on Search Head manually ?

Thanks

0 Karma
Highlighted

Re: App created in Master and deployed to indexers not visible in searchhead

Path Finder

Hi Giuseppe,
Thanks for the quick reply. How can I deploy the app that I created manually to the standalone search head? Will the app and the associated indexes be visible to the user on the search head?

regards,

Nelton

0 Karma
Highlighted

Re: App created in Master and deployed to indexers not visible in searchhead

Legend

Hi neltonk,
you can pack your app (see http://dev.splunk.com/view/webframework-developapps/SP-CAAAEMY ) and then install it using the web interface [Apps -- Manage Apps -- Install App from file].
Otherwise (if you can restart your Search Head it's easier!) you can unpack your App in your PC (if packed) and then copy your unpacked app in $SPLUNK_HOME/etc/apps and then restart Splunk (see https://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall ).

Bye.
Giuseppe

0 Karma
Highlighted

Re: App created in Master and deployed to indexers not visible in searchhead

Legend

Deployer is used only in Search Head Clusters, not in stand alone SH.
In this case, you have to copy App in SH and restart Splunk.
How do you configured Your SH? Did you used the cluster instructions?
Bye.
Giuseppe

0 Karma
Highlighted

Re: App created in Master and deployed to indexers not visible in searchhead

Path Finder

Thanks a lot for all your patient replies

It is standalone implementation. I only configured the clustering for indexers according to splunk documentation. I have packaged the app folder from the indexer node and deployed to the SH but this only has app.conf . I restarted splunk on SH and the app is visible.

Is this correct?

or should I package the app folder under master-apps on the master node(as Woodcock suggested). But this folder only has the indexes.conf and not the app.conf

0 Karma
Highlighted

Re: App created in Master and deployed to indexers not visible in searchhead

Legend

Hi neltonk,,
You can use Master Node ONLY to deploy Apps to Indexers, not to other systems as Search Heads.
On stand alone Search Heads you can only manually install apps (really you could use a Deployment Server but it's mad!)

Let me know your architecture:

  • you have two clustered Indexers,
  • a Master Node that manages the cluster,
  • a stand alone Search Head that is used by the users to query data on cluster, is it correct?

If you want to use an App on a Search Head configured to see the data on Indexers Cluster, you have at first to configure SH following the procedure described at http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Configurethesearchhead .

Then you have to manually copy your custom App on SH (using tar or any other way) at $SPLUNK_HOME/etc/apps and then restart Splunk.

In this way you have:

  • data on clustered Indexers,
  • App on SH,
  • SH configured to search data on Clustered Indexers.

At the end, I don't understand what you mean saying: "I have packaged the app folder from the indexer node and deployed to the SH but this only has app.conf" because you cannot deploy an app to a stand alone SH from an indexer.

Bye.
Giuseppe

0 Karma
Highlighted

Re: App created in Master and deployed to indexers not visible in searchhead

SplunkTrust
SplunkTrust

Hello there,

the Cluster Master distributes apps only to its Cluster Peers (Indexers) to their .../etc/slave-apps/ directory.
it does not distribute any configuration to the Search Peers (Search Heads)
you can add an app manually to the Search Head, or use a Deployment Server.

Hope it helps

Highlighted

Re: App created in Master and deployed to indexers not visible in searchhead

Path Finder

How can I deploy the app that I created manually with an index to the standalone search head? is it possible that the app and the associated indexes be visible to the user on the search head? I am a bit confused after reading about deployer component of splunk. Should I be packaging the app to deploy to search head or use the deployer?

0 Karma