Deployment Architecture

Can you control what gets replicated between search heads?

Splunk Employee
Splunk Employee

I would like to know if there is a way to control what configurations are replicated between search heads in a search head cluster.

1 Solution

Builder

Yes! Via whitelists and black lists located in server.conf. These default stanzas control our default replications:
From Spec:

conf_replication_include. =

* Controls whether Splunk replicates changes to a particular type of *.conf file, along with any associated permissions in *.meta files.
* Defaults to false.

conf_replication_summary.whitelist. =

* Whitelist files to be included in configuration replication summaries.

conf_replication_summary.blacklist. =

* Blacklist files to be excluded from configuration replication summaries.

And our default values:

/opt/splunk/etc/system/default/server.conf conf_deploy_repository = $SPLUNK_HOME/etc/shcluster 
/opt/splunk/etc/system/default/server.conf conf_deploy_staging = $SPLUNK_HOME/var/run/splunk/deploy 
/opt/splunk/etc/system/default/server.conf conf_replication_include.alert_actions = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.collections = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.commands = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.datamodels = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.event_renderers = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.eventtypes = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.fields = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.history = false 
/opt/splunk/etc/system/default/server.conf conf_replication_include.html = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.literals = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.lookups = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.macros = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.manager = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.models = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.multikv = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.nav = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.panels = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.props = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.quickstart = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.savedsearches = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.searchbnf = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.searchscripts = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.segmenters = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.tags = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.times = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.transactiontypes = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.transforms = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.ui-prefs = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.ui-tour = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.user-prefs = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.views = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.viewstates = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.workflow_actions = true 
/opt/splunk/etc/system/default/server.conf conf_replication_summary.blacklist.lookup_index = (system|(apps/*)|users(/_reserved)?/*/*)/lookups/*.(tmp$|index($|/...)) 
/opt/splunk/etc/system/default/server.conf conf_replication_summary.whitelist.lookups = (system|(apps/*)|users(/_reserved)?/*/*)/lookups/* 
/opt/splunk/etc/system/default/server.conf conf_replication_summary.whitelist.refine.local = (system|(apps/*)|users(/_reserved)?/*/*)/(local/...|metadata/local.meta) 
/opt/splunk/etc/system/default/server.conf conf_replication_summary.whitelist.repo = system/replication/*.json 

View solution in original post

Splunk Employee
Splunk Employee
0 Karma

Builder

Yes! Via whitelists and black lists located in server.conf. These default stanzas control our default replications:
From Spec:

conf_replication_include. =

* Controls whether Splunk replicates changes to a particular type of *.conf file, along with any associated permissions in *.meta files.
* Defaults to false.

conf_replication_summary.whitelist. =

* Whitelist files to be included in configuration replication summaries.

conf_replication_summary.blacklist. =

* Blacklist files to be excluded from configuration replication summaries.

And our default values:

/opt/splunk/etc/system/default/server.conf conf_deploy_repository = $SPLUNK_HOME/etc/shcluster 
/opt/splunk/etc/system/default/server.conf conf_deploy_staging = $SPLUNK_HOME/var/run/splunk/deploy 
/opt/splunk/etc/system/default/server.conf conf_replication_include.alert_actions = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.collections = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.commands = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.datamodels = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.event_renderers = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.eventtypes = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.fields = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.history = false 
/opt/splunk/etc/system/default/server.conf conf_replication_include.html = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.literals = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.lookups = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.macros = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.manager = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.models = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.multikv = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.nav = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.panels = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.props = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.quickstart = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.savedsearches = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.searchbnf = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.searchscripts = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.segmenters = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.tags = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.times = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.transactiontypes = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.transforms = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.ui-prefs = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.ui-tour = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.user-prefs = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.views = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.viewstates = true 
/opt/splunk/etc/system/default/server.conf conf_replication_include.workflow_actions = true 
/opt/splunk/etc/system/default/server.conf conf_replication_summary.blacklist.lookup_index = (system|(apps/*)|users(/_reserved)?/*/*)/lookups/*.(tmp$|index($|/...)) 
/opt/splunk/etc/system/default/server.conf conf_replication_summary.whitelist.lookups = (system|(apps/*)|users(/_reserved)?/*/*)/lookups/* 
/opt/splunk/etc/system/default/server.conf conf_replication_summary.whitelist.refine.local = (system|(apps/*)|users(/_reserved)?/*/*)/(local/...|metadata/local.meta) 
/opt/splunk/etc/system/default/server.conf conf_replication_summary.whitelist.repo = system/replication/*.json 

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!