Deployment Architecture

Copying apps from one splunk installation to another


What if I have apps deployed in all-in-one architecture (search head, indexer, etc. in the same server) and I want to migrate this apps into a distributed architecture, (search head server is separated from indexer server and so on), Should I copy the $SPLUNK_HOME/etc/apps anyway? If so, where should I copy it?

0 Karma

Esteemed Legend

Do as @cusello says if you wrote the app. If not, go back to splunkbase and read about each app; the description will tell you which parts of which apps go on which types of Splunk servers.

0 Karma


Hi ldevita,
copying the full App folder in each server is surely the easiest way to distribute your App, but you risk to have problems in following evolution.
The best way is to divide your App between the main roles, creating two Apps, one for Indexers and one for Search Heads.
- indexers.conf only on Indexers;
- props.conf and transforms.conf both on indexers and Search Heads;
- all the other files (tags, eventtypes, dashboards savedsearches, etc... only on Search Heads.
If you have an Indexers Cluster, you have to copy files on Master Node.
If you have more than one not clustered Indexers and you have a Deployment Server, you could use this to deploy files in a Technical Add-on.
If you have a Search Heads Cluster, you have to copy files on Deployer.

Only one suggest: beware to all App Knowledge Objects shared Level, copying $SPLUNK_HOME/etc/apps/your_app in the new locations private objects will not be copied.


0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST