Deployment Architecture

Deployer overwritting app configuration

coreyf311
Path Finder

I created a barebones app on the deployer, copied it to shcluster/apps directory and pushed it to the 6 nodes of our SHC. Then, I configured the app from within the SHC with saved searches, dashboards, setup the NAV bar the way I wanted, etc. Same thing I have done many many times. A second push from the deployer seems to reset this app back to barbones. All the previous configuration is gone. This happened twice. Configured the app and it gets reset back to barebones after another push from the deployer.

splunk enterprise version 7.0.2

Tags (1)
0 Karma
1 Solution

coreyf311
Path Finder

turns out an old, thought to be decomm'd server that WAS our old deployer was turned on again and pushing bundles to the SHC via a script we have running. DOH

View solution in original post

0 Karma

coreyf311
Path Finder

turns out an old, thought to be decomm'd server that WAS our old deployer was turned on again and pushing bundles to the SHC via a script we have running. DOH

0 Karma

somesoni2
Revered Legend

How are you configuring those searches/navigations, updates from Splunk Web UI or directly on filesystem of the SHC members? If directly on file system, which app sub directories (default or local) you're creating those objects?

0 Karma

coreyf311
Path Finder

Splunk Web. I can confirm that the changes where replicated to all members before being wiped by the deployer.

0 Karma

somesoni2
Revered Legend

Whats the app.conf value you're using on SHC Deployer (with your barebones app directory)? I use something like this and it works fine.

[install]
state = enabled

[ui]
is_visible = 1
label = App Title

[launcher]
author = AuthorName
description = App Description
version = 1.0
0 Karma

coreyf311
Path Finder

[install]
is_configured = 0

[ui]
is_visible = 1
label = App Title

[launcher]
author = AuthorName
description = App Description
version = 1.0

This is how the app.conf was configured when I created the barebones app in the deployers splunk web. Its the same as many many other apps we have created in the same fashion and pushed out. Once the barebones app is pushed to the cluster, we do the configuration with the SHC. None of these other apps have the same issue.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...