Hi, I have recently installed a Splunk cluster. My configuration is supposed to be 1 Master(also the licensing master) , 3 indexer peers, *1 search head : indexing turned off *. I have created a basic configuration bundle - a folder for myapp1 under in master-apps on the master node:
validated the bundle and on success applied to cluster. This created the index and app on the indexers. I had to make the app visible on the indexers however I don't see the app on the search head. How do I make sure the app is visible to users who will only login to the search head. is there another procedure for this? Please help.
To manually deploy the app to the search head, tar it back up like this:
cd $SPLUNK_HOME/master-apps tar czvf SendMeToSearchHead.tgz ./YourAppDirNameHere
Then use whatever tool that you like to transfer it to your Search Head into
$SPLUNK_HOME/apps and do this
tar xvf ./SendMeToSearchHead.tgz rm -f ./SendMeToSearchHead.tgz
However, it is uncommon for any app with
is_visible to be appropriate for both your Search Head and Indexer tier. I would stop and make absolutely sure that this is what you should be doing.
Yes, it is VERY common to deploy an
indexes.conf app via
master-apps to the slaves. It should have an
app.conf but isn't necessary. You need the
indexes.conf app on your Search Head, too, otherwise you will not be able to limit certain people/roles to certain index values because the Search Head will not know about all index values.
How can I deploy the app that I created manually with an index to the standalone search head? is it possible that the app and the associated indexes be visible to the user on the search head? I am a bit confused after reading about deployer component of splunk. Should I be packaging the app to deploy to search head or use the deployer?
the Cluster Master distributes apps only to its Cluster Peers (Indexers) to their .../etc/slave-apps/ directory.
it does not distribute any configuration to the Search Peers (Search Heads)
you can add an app manually to the Search Head, or use a Deployment Server.
Hope it helps
Master Node manages only Indexers, not Search Heads (see http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Clusterdeploymentoverview ).
You correctly deployed App to indexers using Master Node but you have to manually install app on the Search Head.
you can pack your app (see http://dev.splunk.com/view/webframework-developapps/SP-CAAAEMY ) and then install it using the web interface [Apps -- Manage Apps -- Install App from file].
Otherwise (if you can restart your Search Head it's easier!) you can unpack your App in your PC (if packed) and then copy your unpacked app in $SPLUNK_HOME/etc/apps and then restart Splunk (see https://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall ).
Deployer is used only in Search Head Clusters, not in stand alone SH.
In this case, you have to copy App in SH and restart Splunk.
How do you configured Your SH? Did you used the cluster instructions?
Thanks a lot for all your patient replies
It is standalone implementation. I only configured the clustering for indexers according to splunk documentation. I have packaged the app folder from the indexer node and deployed to the SH but this only has app.conf . I restarted splunk on SH and the app is visible.
Is this correct?
or should I package the app folder under master-apps on the master node(as Woodcock suggested). But this folder only has the indexes.conf and not the app.conf
You can use Master Node ONLY to deploy Apps to Indexers, not to other systems as Search Heads.
On stand alone Search Heads you can only manually install apps (really you could use a Deployment Server but it's mad!)
Let me know your architecture:
If you want to use an App on a Search Head configured to see the data on Indexers Cluster, you have at first to configure SH following the procedure described at http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Configurethesearchhead .
Then you have to manually copy your custom App on SH (using tar or any other way) at $SPLUNK_HOME/etc/apps and then restart Splunk.
In this way you have:
At the end, I don't understand what you mean saying: "I have packaged the app folder from the indexer node and deployed to the SH but this only has app.conf" because you cannot deploy an app to a stand alone SH from an indexer.
Thanks for the quick reply. How can I deploy the app that I created manually to the standalone search head? Will the app and the associated indexes be visible to the user on the search head?