Deployment Architecture

Deploy app to distributed search head

craigmunro
Path Finder

Hi

I'm trying to use the deployment server to deploy apps to my search head.

The app is installed in $SPLUNK_HOME/etc/apps which would normally be correct but the config for the pooled search head is stored on a shared drive.

The app.conf file in the shared location appears to be updated but not any of the other files.

Should I update serverclass.conf to specify the shared location as the targetRepositoryLocation? What happens if I have multiple search heads?

Is this supported/recommended?

I'm using Splunk 4.2.1

Thanks

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

I think you should update deploymentclient.conf to change the repositoryLocation to be the pool location:

[deployment-client]
repositoryLocation = /path/to/shared/storage/etc/apps

And you should only set up one of the search heads (in each pool if you have more than one pool) as a Deployment Server client.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

I think you should update deploymentclient.conf to change the repositoryLocation to be the pool location:

[deployment-client]
repositoryLocation = /path/to/shared/storage/etc/apps

And you should only set up one of the search heads (in each pool if you have more than one pool) as a Deployment Server client.

weeb
Splunk Employee
Splunk Employee

FYI: clientName does not need to be set unless the desired effect is to replace the hostname (from DNS) with this specified value.

0 Karma

craigmunro
Path Finder

Thanks, that works but I also had to add the location policy.


[deployment-client]
clientName=search_head
repositoryLocation = /path/to/shared/storage/etc/apps
serverRepositoryLocationPolicy = rejectAlways
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...