Deployment server for new Indexers

[sanju005ind]

I have 8 Indexers in my environment.I would like to keep the configurations especially the props.conf and the Transforms.conf similiar in all the indexers. Can I achieve that with a Deployment server.Does it push the conf files to a specific directory or should everything be under etc/apps directory?

[Rob · Accepted solution]

You may want to take a look at the answer posted here.

More specifically, you will want to take a look at the serverclass.conf file so that you can set up the source directory of the config files you want to deploy as well as the target directory.

Lastly, you will need to configure the client to be sure to grab the config files. The documentation illustrates this quite nicely in the terms of apps but config files can be deployed in a similar manner.

[sanju005ind]

I was thinking to point it to etc/system/local.Thanks kanapathy for the warning.

[gkanapathy]

You can point to any location, but it will be pretty pointless unless you point it to etc/apps. I hope you're not thinking of pointing it at, say, etc/system or etc/system/local, as it will wipe and replace the entire folder, not files at a time. This will cause you considerable grief.

[sanju005ind]

Can I set the targetRepositoryLocation to any folder within the $SPLUNK_HOME$ or does it have to be under $SPLUNK_HOME$/etc/apps/

[sanju005ind]

also would like to see same set of indexes.conf file on all the indexers.