Deployment Architecture
Highlighted

How do I make changes to server.conf?

Builder

I need to make some changes and Splunk proServe tells me that I can use the deployment server to make this change. How is this done outside of the ../etc/systemp/local/ dir? Bundle it in an app? If so what about precedence?

Any guidance is appreciated!

0 Karma
Highlighted

Re: How do I make changes to server.conf?

Ultra Champion

Interesting thing. For /opt/splunk/etc/system/local/server.conf on the SH, for example, I make the changes on each SH and bounce each one. The deployment server only deploys to the forwarders...

0 Karma
Highlighted

Re: How do I make changes to server.conf?

SplunkTrust
SplunkTrust

the deployment server can deploy to any non-clustered splunk instance
Indexer, Search Head, Heavy Forwarder and more
also, it can not deploy to itself

0 Karma
Highlighted

Re: How do I make changes to server.conf?

SplunkTrust
SplunkTrust

yes you will bundle configurations in an app.
splunk configuration precedence is*:
1. System local directory -- highest priority
2. App local directories
3. App default directories
4. System default directory -- lowest priority

hope it helps

0 Karma
Highlighted

Re: How do I make changes to server.conf?

Esteemed Legend

Any configuration in $SPLUNK_HOME/etc/system/local/ is GOD and cannot be overridden by anything in $SPLUNK_HOME/etc/apps/ (the stuff that is pulled in from the Deployment Server). You have to migrate that stuff out of $SPLUNK_HOME/etc/system/local/ first (it never should have been put there).

View solution in original post

0 Karma
Highlighted

Re: How do I make changes to server.conf?

Builder

OK this is exactly what I thought, I appreciate your time!
Thanks everyone.

0 Karma