Deployment Architecture

How do you create a new empty app in a clustered environment?

EmEdwards
Path Finder

I know how to create an app from the GUI of Splunk. But, on a clustered environment, I believe this needs to be created on the deployer. I cannot find any documentation that gives step by step help to create a new empty app on a clustered Linux environment.

I do not know linux much at all, and am only needing to deploy a new empty base app.

Any pointers to documentation or help would be great ! Thanks.

1 Solution

vliggio
Communicator

An application is just a directory. You can create a directory in the /opt/splunk/etc/shcluster/apps directory and then run the command /opt/splunk/bin/splunk apply apply shcluster-config command and it will push that directory to your cluster.

Note that the directory structure within an app is exactly the same for a standalone and a clustered app. Only difference is the standalone one is in etc/apps and the clustered one is in etc/shcluster/apps.

When I create app directories I do put a few files such as default.meta and app.conf which allow configuring permissions, app name, etc.

View solution in original post

ddrillic
Ultra Champion
0 Karma

vliggio
Communicator

An application is just a directory. You can create a directory in the /opt/splunk/etc/shcluster/apps directory and then run the command /opt/splunk/bin/splunk apply apply shcluster-config command and it will push that directory to your cluster.

Note that the directory structure within an app is exactly the same for a standalone and a clustered app. Only difference is the standalone one is in etc/apps and the clustered one is in etc/shcluster/apps.

When I create app directories I do put a few files such as default.meta and app.conf which allow configuring permissions, app name, etc.

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...