Deployment Architecture

Deployment Server and HeavyForwarder app local folder

splunkreal
Motivator

Hello,

if we have on DS "app/local" with conf files, is that possible restarting it that it pushes DS "app/local" to HF "app/local" and deletes custom local conf files on HF (created from HF GUI)?

Thanks.

* If this helps, please upvote or accept solution if it solved *
0 Karma
1 Solution

kiran_panchavat
Contributor

@splunkreal 

The configuration file props.conf will be stored in $SPLUNK_HOME/etc/apps(Heavy forwarder) if you generate it on the deployment server at $SPLUNK_HOME/etc/deployment-apps and send it to the heavy forwarders via the deployment server.

Please remove the file before pushing it from the deployment server; otherwise, it will not automatically appear in the /etc/apps (heavy forwarder) when the deployment server is reloaded. It will surpass.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Updating/Createdeploymentapps 

How to edit a configuration file - Splunk Documentation 

View solution in original post

splunkreal
Motivator

Hi @kiran_panchavat renaming DS "app/local" to "app/local.OLD" is enough? Thanks.

 

* If this helps, please upvote or accept solution if it solved *
0 Karma

kiran_panchavat
Contributor

@splunkreal 

The configuration file props.conf will be stored in $SPLUNK_HOME/etc/apps(Heavy forwarder) if you generate it on the deployment server at $SPLUNK_HOME/etc/deployment-apps and send it to the heavy forwarders via the deployment server.

Please remove the file before pushing it from the deployment server; otherwise, it will not automatically appear in the /etc/apps (heavy forwarder) when the deployment server is reloaded. It will surpass.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Updating/Createdeploymentapps 

How to edit a configuration file - Splunk Documentation 

Get Updates on the Splunk Community!

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...