How to compare the .conf consistency across all nodes in a SHC ?

[Glasses2]

Hi, 

Does anyone have a method or an app or query that can check and compare the confs between all SHC members?  

Perhaps there is a way with btool or rysnc.  

I was given a PS Tech Assessment App but it is not working correctly.  I don't think the PS Tech knew how to install it or use it.

Thank you

[gcusello]

Hi @Glasses2 ,

whwy do you want to compare conf files between SHC members?

All apps are replicated between them the only differences can be in $SPLUNK_HOME/etc/system/local.

Anyway, to extract configurations using btool it could be a good and easy approach.

in addition there's an app (sincerely that I never used!) called "Conf Inspactor" (https://splunkbase.splunk.com/app/3957) that probably solves your need.

Ciao.

Giuseppe

[Glasses2]

@gcusello 

Thank you for the reply and suggestion.

I agree with you about replication, however in my case, the shc was not replicating correctly.  The previous admin did not know what he was doing and others were restarting shc nodes individually causing corruption.

Specifically I was seeing transforms in the search app that were not replicating correctly.  As well the lookups were different across the shc nodes.

Its a real mess!

The PS assessment app has a conf checker but it is not working correctly and is probably missing a dependency.    I will try you suggestion and get back to you.  TY!

[Glasses2 · Accepted solution]

Admins Little Hepler for Splunk seems to work

https://splunkbase.splunk.com/app/6368

[Glasses2]

the conf-inspector has less functionality

https://splunkbase.splunk.com/app/3957

[gcusello]

Hi @Glasses2,

good for you, anyway, when you'll consolidate your apps and lookups, deploy them again from the Deployer to have a clean configuration.

Ciao.

Giuseppe

[gcusello]

Hi @Glasses2,

using btool you can identify differences in conf file, not differences in lookups, so maybe it could be a good idea to take all lookups, consolidate them in on lookup.

Then, for Conf files, take all the configurations using btool and consolidate them in a new app version for each app, then push apps and lookups from the Deployer.

Let me know if I could help you more.

Ciao.

Giuseppe