Deployment Architecture

Editing config files in a SH cluster

laberthelemy
Engager

When I create a saved search through the web UI on a SH, it's replicated to other members in the cluster.
But if I create or modify a saved search directly in the config file (vi $SPLUNK_HOME/etc/apps/search/local/savedsearches.conf),
the modification is not visible on any member, including the host on which we modify the conf file.
But I can find the right stanza with btool.

My goal is to migrate saved searches from the current standalone SH to the new cluster.

0 Karma

somesoni2
Revered Legend

That behavior is by design. The SHCluster only replicates changes made from Splunk Web, Splunk CLI and REST endpoints. See more details here.
http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/HowconfrepoworksinSHC#The_changes_that_...

Option for you would be to either to make changes in one SH and replicate manually to other SH node OR use CLI or REST method to add/update the search (see this http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTsearchExamples#saved.2Fsearches_POST)

0 Karma
Get Updates on the Splunk Community!

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...