- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Does anyone have a method or an app or query that can check and compare the confs between all SHC members?
Perhaps there is a way with btool or rysnc.
I was given a PS Tech Assessment App but it is not working correctly. I don't think the PS Tech knew how to install it or use it.
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Admins Little Hepler for Splunk seems to work
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @Glasses2 ,
whwy do you want to compare conf files between SHC members?
All apps are replicated between them the only differences can be in $SPLUNK_HOME/etc/system/local.
Anyway, to extract configurations using btool it could be a good and easy approach.
in addition there's an app (sincerely that I never used!) called "Conf Inspactor" (https://splunkbase.splunk.com/app/3957) that probably solves your need.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for the reply and suggestion.
I agree with you about replication, however in my case, the shc was not replicating correctly. The previous admin did not know what he was doing and others were restarting shc nodes individually causing corruption.
Specifically I was seeing transforms in the search app that were not replicating correctly. As well the lookups were different across the shc nodes.
Its a real mess!
The PS assessment app has a conf checker but it is not working correctly and is probably missing a dependency. I will try you suggestion and get back to you. TY!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the conf-inspector has less functionality
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @Glasses2,
good for you, anyway, when you'll consolidate your apps and lookups, deploy them again from the Deployer to have a clean configuration.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @Glasses2,
using btool you can identify differences in conf file, not differences in lookups, so maybe it could be a good idea to take all lookups, consolidate them in on lookup.
Then, for Conf files, take all the configurations using btool and consolidate them in a new app version for each app, then push apps and lookups from the Deployer.
Let me know if I could help you more.
Ciao.
Giuseppe
