Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Re: How can I propagate changes to /system/local ....
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want to make some changes to certain .conf files in system local for my search head cluster. I know that the deployer pushes the apps and user configurations. I also know that the captain pushes changes made through the GUI. I don't know how to make changes to outputs.conf for instance and have those changes get propagated across the cluster. Are configurations only possible using the command line interface or is there another way where I can modify and send these configuration files across the cluster?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You should be able to add you outputs.conf changes in an app and deploy that app using Deployer. That way you'd have better control over the SHC configuration.
Making changes (made directory) to file system, where it's in etc/system/local OR etc/apps, will not get replicated. However, you can update the outputs.conf content using CLI and those changes will get replicated (at least whatever changes being supported by CLI).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You should be able to add you outputs.conf changes in an app and deploy that app using Deployer. That way you'd have better control over the SHC configuration.
Making changes (made directory) to file system, where it's in etc/system/local OR etc/apps, will not get replicated. However, you can update the outputs.conf content using CLI and those changes will get replicated (at least whatever changes being supported by CLI).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hI @SOMESONI2 ,
Is it possible to edit outputs.conf via CLI. I couldnt find any doc on it. Could you re-direct me to teh same?
Level Up Your .conf25: Splunk Arcade Comes to Boston
Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
