Deployment Architecture

How to deploy savedsearches.conf to single SH server via splunk function

syokota_splunk
Splunk Employee
Splunk Employee

Hi teachers,

Now I seek how to deploy savedsearches.conf to single SH (not SH cluster) via splunk function.
The reason why I seek is I'dl like to share the schadule search and alert function to 2 or more single SHs server with automatically.

My understanding is
- If the SH cluster then use deployer

But if the single SH then use anything? deployment server or OSS?

Thanks,
Satoshi

Tags (1)
0 Karma
1 Solution

damien_chillet
Builder

If you want to share configurations to several search heads that are non-clustered, you can configure the search heads as deployment clients and distribute your saved searches and alerts configurations inside an application.

You will need to create a server class for these 3 search heads and add the application to that server class.

More more details on how to proceed, please refer to the following docs: http://docs.splunk.com/Documentation/Splunk/7.0.0/Updating/Configuredeploymentclients

View solution in original post

0 Karma

damien_chillet
Builder

If you want to share configurations to several search heads that are non-clustered, you can configure the search heads as deployment clients and distribute your saved searches and alerts configurations inside an application.

You will need to create a server class for these 3 search heads and add the application to that server class.

More more details on how to proceed, please refer to the following docs: http://docs.splunk.com/Documentation/Splunk/7.0.0/Updating/Configuredeploymentclients

0 Karma

syokota_splunk
Splunk Employee
Splunk Employee

Thank you damien!
I make deploymentclient.conf in SH and restart it. And I found deployed app under "/opt/splunk/etc/app" in SH.

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...