Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- How do I make changes to server.conf?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need to make some changes and Splunk proServe tells me that I can use the deployment server to make this change. How is this done outside of the ../etc/systemp/local/ dir? Bundle it in an app? If so what about precedence?
Any guidance is appreciated!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Any configuration in $SPLUNK_HOME/etc/system/local/ is GOD and cannot be overridden by anything in $SPLUNK_HOME/etc/apps/ (the stuff that is pulled in from the Deployment Server). You have to migrate that stuff out of $SPLUNK_HOME/etc/system/local/ first (it never should have been put there).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Any configuration in $SPLUNK_HOME/etc/system/local/ is GOD and cannot be overridden by anything in $SPLUNK_HOME/etc/apps/ (the stuff that is pulled in from the Deployment Server). You have to migrate that stuff out of $SPLUNK_HOME/etc/system/local/ first (it never should have been put there).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK this is exactly what I thought, I appreciate your time!
Thanks everyone.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes you will bundle configurations in an app.
splunk configuration precedence is*:
1. System local directory -- highest priority
2. App local directories
3. App default directories
4. System default directory -- lowest priority
- indexers in a cluster (slaves) have slightly different precedence order. read more here: http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Wheretofindtheconfigurationfiles
hope it helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Interesting thing. For /opt/splunk/etc/system/local/server.conf on the SH, for example, I make the changes on each SH and bounce each one. The deployment server only deploys to the forwarders...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the deployment server can deploy to any non-clustered splunk instance
Indexer, Search Head, Heavy Forwarder and more
also, it can not deploy to itself
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
