Deployment Architecture

Copying apps from one splunk installation to another


What if I have apps deployed in all-in-one architecture (search head, indexer, etc. in the same server) and I want to migrate this apps into a distributed architecture, (search head server is separated from indexer server and so on), Should I copy the $SPLUNK_HOME/etc/apps anyway? If so, where should I copy it?

0 Karma

Esteemed Legend

Do as @cusello says if you wrote the app. If not, go back to splunkbase and read about each app; the description will tell you which parts of which apps go on which types of Splunk servers.

0 Karma

Esteemed Legend

Hi ldevita,
copying the full App folder in each server is surely the easiest way to distribute your App, but you risk to have problems in following evolution.
The best way is to divide your App between the main roles, creating two Apps, one for Indexers and one for Search Heads.
- indexers.conf only on Indexers;
- props.conf and transforms.conf both on indexers and Search Heads;
- all the other files (tags, eventtypes, dashboards savedsearches, etc... only on Search Heads.
If you have an Indexers Cluster, you have to copy files on Master Node.
If you have more than one not clustered Indexers and you have a Deployment Server, you could use this to deploy files in a Technical Add-on.
If you have a Search Heads Cluster, you have to copy files on Deployer.

Only one suggest: beware to all App Knowledge Objects shared Level, copying $SPLUNK_HOME/etc/apps/your_app in the new locations private objects will not be copied.


0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...