Apps under search head under /opt/splunk/etc/apps/ are not replicating to search peers /opt/splunk/var/run/searchpeers/

[vmadala]

Apps under search head under /opt/splunk/etc/apps/ are not replicating to search peers /opt/splunk/var/run/searchpeers/

Here is my setup - I have a standalone search head which has indexers as search peers.

I have deployed apps to search head and they are not replicating to search peers.

[gcusello]

Hi @vmadala ,

a stand-alone Search Head doesn't replicate any app to Search Peers.

A SH replicates apps only to other SHs ony if they are clustered in a Search Head Cluster.

Apps on Indexers are deployed by the Cluster Manager (in an Indexer Cluster), manually or by Deployment Server in not clustered Indexers.

Ciao.

Giuseppe

[PickleRick]

That's true, but not entirely true.

Things that are needed for the initial phase of search should be replicated to search peers as a so called "knowledge bundle". Otherwise search peers couldn't - for example - extract fields and search for those fields within the events since TAs are typically installed on SHs if they only contain search-time settings.

So there are things that are pushed from the SH tier to the indexer tier (I'm not sure how it works with federated search; never tested it).

So generally, yes - your search peers should receive the knowledge bundle from the SH.

You should have subdirectories in $SPLUNK_HOME/var/run/searchpeers/ on your indexers containing knowledge bundle (some subset of etc/system, etc/apps and etc/users).

EDIT: But this will be a subset of the contents of those directories so Splunk might decide that some of the settings are not used at all in the indexer tier so will not be replicated (for example I could expect alert_actions.conf not being pushed as part of the knowledge bundle since an alert action will not be fired on an indexer, it will be run on a SH).