Deployment Architecture

How to create an app in Splunk to store the configs that would make my forwarder pick data from a location?

sundaresh83
Explorer

Hi...
I want to create an app in splunk to store the configs that would make my forwarder pick data from a location. I read the create deployment app document in splunk, which talked about creating a directory in dplunk_home. I find that the splunk web has a create app option... Is it not easy to do it that way? What is the difference between both?

Labels (1)
Tags (2)
0 Karma
1 Solution

tom_frotscher
Builder

What you want to do is to create a deployment app. What you can do with the help of the "create app" option in the UI is to create a normal splunk app. Splunk apps are stored in splunk_home/etc/apps and deployment apps are stored in splunk_home/etc/deployment-apps. Deployment-apps are used to deploy configurations (most of the time inputs.conf and outputs.conf) on forwarders via deployment server. A normal app also contains configurations, visualizations or dashboards, but normally it is not used with the deployment server.

View solution in original post

sundaresh83
Explorer

@ tom_frotscher

Thanks for the reply. In my case, to create the deployment app, is the only option to create it under default location : $SPLUNK_HOME/etc/deployment-apps? Or could I use the GUI (splunk web) to create a deployment app?

0 Karma

sundaresh83
Explorer

@ tom_frotscher

I am able to create a directory under the deployment-apps using the mkdir command say "def". Under this folder I also created a subdir lets say "abc".
But I am unable to run the command "reload deploy-server" (also tried just "splunk reload deploy-server") to make the deployment server aware of them . It gives me an error "reload: Unknown job: deploy-server".

I am also unable to find the app in forwarder management. Please HELP!!

0 Karma

tom_frotscher
Builder

A deployment app has to be in the deployment app folder. Of course you can create a normal app and copy the app folder to the deployment app folder. I think you need to edit the app.conf after you copied the folder.

Can you explain the problem, why can you not create the folder manually? You don't have permissions to do so?

tom_frotscher
Builder

What you want to do is to create a deployment app. What you can do with the help of the "create app" option in the UI is to create a normal splunk app. Splunk apps are stored in splunk_home/etc/apps and deployment apps are stored in splunk_home/etc/deployment-apps. Deployment-apps are used to deploy configurations (most of the time inputs.conf and outputs.conf) on forwarders via deployment server. A normal app also contains configurations, visualizations or dashboards, but normally it is not used with the deployment server.

Iarn
Observer

is it possible to create app, which will place some apps to deployemnt apps? 

i believe it is possible with some other scripts in bin dir, but... is there any way to create such thing without scripts?

 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...