Deployment Architecture

How Does a Deployment Server Decide When to Deploy an App?

tiberious726
Path Finder

I am aware that the deployment server compares the hash of its copy of a given app against the hash the apps of its deployment clients, however, Splunk is definitely not hashing the entire app directory, as, for example, the SoS app updates a lookup table "lookups/splunk_servers_cache.csv " which doesn't so much as exist on the deployment server's version of the app.

Which parts of an app does the Deployment Server hash?

Tags (1)
0 Karma
1 Solution

tiberious726
Path Finder

So it turns out that I was mistaken, the deployment server is indeed hashing and redeploying the entire app directory, which ends up overriding SoS's lookups/splunk_servers_cache.csv (plus, of course, every other app's generated files) but SoS quickly regenerates it. What threw me off is that because of search distribution, the indexer also shows up in this list (which is generated with the custom "btool" search command)

View solution in original post

0 Karma

tiberious726
Path Finder

So it turns out that I was mistaken, the deployment server is indeed hashing and redeploying the entire app directory, which ends up overriding SoS's lookups/splunk_servers_cache.csv (plus, of course, every other app's generated files) but SoS quickly regenerates it. What threw me off is that because of search distribution, the indexer also shows up in this list (which is generated with the custom "btool" search command)

0 Karma

tiberious726
Path Finder

As far as I am aware, all that that command does is tell the deployment server to instruct the deployment clients to redo their handshake, recomparing their hashes against the has of the version on the deployment server.

(If your thought was that the handshake hasn't been redone since the lookups file was updated, that isn't the case. We run reload deploy server at the very least once a week, and the file has differed for a very long time)

To further clarify, my goal isn't to force the deployment server to redeploy the apps, but rather to understand the conditions thereof.

0 Karma

cramasta
Builder

have you run the command below on the deployment server after making the change to the app?

splunk reload deploy-server

0 Karma

tiberious726
Path Finder

I should add that it is definitely not just the default/ directory, as I have seen updates in appserver/ and local/ cause a redeploy (And since local/app.conf is generated on the client if missing, the app will redeploy perpetually if you don't have that file)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...