Deployment Architecture

How to compare the .conf consistency across all nodes in a SHC ?

Glasses2
Communicator

Hi, 

Does anyone have a method or an app or query that can check and compare the confs between all SHC members?  

Perhaps there is a way with btool or rysnc.  

I was given a PS Tech Assessment App but it is not working correctly.  I don't think the PS Tech knew how to install it or use it.

Thank you

Labels (1)
0 Karma
1 Solution

Glasses2
Communicator

Admins Little Hepler for Splunk seems to work

https://splunkbase.splunk.com/app/6368

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Glasses2 ,

whwy do you want to compare conf files between SHC members?

All apps are replicated between them the only differences can be in $SPLUNK_HOME/etc/system/local.

Anyway, to extract configurations using btool it could be a good and easy approach.

in addition there's an app (sincerely that I never used!) called "Conf Inspactor" (https://splunkbase.splunk.com/app/3957) that probably solves your need.

Ciao.

Giuseppe

0 Karma

Glasses2
Communicator

@gcusello 

Thank you for the reply and suggestion.

I agree with you about replication, however in my case, the shc was not replicating correctly.  The previous admin did not know what he was doing and others were restarting shc nodes individually causing corruption.

Specifically I was seeing transforms in the search app that were not replicating correctly.  As well the lookups were different across the shc nodes.

Its a real mess!

The PS assessment app has a conf checker but it is not working correctly and is probably missing a dependency.    I will try you suggestion and get back to you.  TY!

0 Karma

Glasses2
Communicator

Admins Little Hepler for Splunk seems to work

https://splunkbase.splunk.com/app/6368

0 Karma

Glasses2
Communicator

the conf-inspector has less functionality

https://splunkbase.splunk.com/app/3957

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Glasses2,

good for you, anyway, when you'll consolidate your apps and lookups, deploy them again from the Deployer to have a clean configuration.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Glasses2,

using btool you can identify differences in conf file, not differences in lookups, so maybe it could be a good idea to take all lookups, consolidate them in on lookup.

Then, for Conf files, take all the configurations using btool and consolidate them in a new app version for each app, then push apps and lookups from the Deployer.

Let me know if I could help you more.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...