Deployment Architecture

How to create an app in Splunk to store the configs that would make my forwarder pick data from a location?

sundaresh83
Explorer

Hi...
I want to create an app in splunk to store the configs that would make my forwarder pick data from a location. I read the create deployment app document in splunk, which talked about creating a directory in dplunk_home. I find that the splunk web has a create app option... Is it not easy to do it that way? What is the difference between both?

Labels (1)
Tags (2)
0 Karma
1 Solution

tom_frotscher
Builder

What you want to do is to create a deployment app. What you can do with the help of the "create app" option in the UI is to create a normal splunk app. Splunk apps are stored in splunk_home/etc/apps and deployment apps are stored in splunk_home/etc/deployment-apps. Deployment-apps are used to deploy configurations (most of the time inputs.conf and outputs.conf) on forwarders via deployment server. A normal app also contains configurations, visualizations or dashboards, but normally it is not used with the deployment server.

View solution in original post

sundaresh83
Explorer

@ tom_frotscher

Thanks for the reply. In my case, to create the deployment app, is the only option to create it under default location : $SPLUNK_HOME/etc/deployment-apps? Or could I use the GUI (splunk web) to create a deployment app?

0 Karma

sundaresh83
Explorer

@ tom_frotscher

I am able to create a directory under the deployment-apps using the mkdir command say "def". Under this folder I also created a subdir lets say "abc".
But I am unable to run the command "reload deploy-server" (also tried just "splunk reload deploy-server") to make the deployment server aware of them . It gives me an error "reload: Unknown job: deploy-server".

I am also unable to find the app in forwarder management. Please HELP!!

0 Karma

tom_frotscher
Builder

A deployment app has to be in the deployment app folder. Of course you can create a normal app and copy the app folder to the deployment app folder. I think you need to edit the app.conf after you copied the folder.

Can you explain the problem, why can you not create the folder manually? You don't have permissions to do so?

tom_frotscher
Builder

What you want to do is to create a deployment app. What you can do with the help of the "create app" option in the UI is to create a normal splunk app. Splunk apps are stored in splunk_home/etc/apps and deployment apps are stored in splunk_home/etc/deployment-apps. Deployment-apps are used to deploy configurations (most of the time inputs.conf and outputs.conf) on forwarders via deployment server. A normal app also contains configurations, visualizations or dashboards, but normally it is not used with the deployment server.

Iarn
Observer

is it possible to create app, which will place some apps to deployemnt apps? 

i believe it is possible with some other scripts in bin dir, but... is there any way to create such thing without scripts?

 

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...