Deployment Architecture

Deployment Server not synchronizing/pushing individual files?

icewolf69
Loves-to-Learn Everything

I've been trying to find an answer to this, and it seems like it's supposed to work. So I'm not sure if I have a misconfiguration or if I'm doing something wrong.

I have a deployment server setup to deploy 1 or 2 apps.  If I go to a machine that has the deployment server configured, and has had the configured app installed (Through the deployment server), and I delete configuration files, etc; the files never get replaced by the deployment server.

It will replace files if i delete the entire app folder... but not individual files.  

Would anyone have any clues on why this is happening?

I have tried the "reload deploy-server" command but it didn't seem to do anything.  Am I being unrealistic to assume individual files would also be checked against the deployment server app?  I want to ensure that inputs, outputs, etc are uniform. And if some were to get deleted or changed, I would need the change to get pushed; for example if someone went in and deleted conf files intentionally or accidently.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

if I recall right DS has counted a check sum for that app when it has installed it. This check sum has stored into some var dire/files (cannot recall it now). When DC connect to DS those just check if these check sums differ and if then redeploy it. Of course it also checks if that app directory is on present.

Probably that was covered some how in this blog post https://hurricanelabs.com/splunk-tutorials/under-the-hood-examining-your-splunk-deployment-server/ ?

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...