Deployment Architecture

How to migrate savedsearches.conf from one search head cluster to another?

brent_weaver
Builder

I need to migrate two savedsearches.conf files to a new search head cluster:

/opt/splunk/etc/apps/search/local/savedsearches.conf
/opt/splunk/etc/users/212059627/search/local/savedsearches.conf

How do I do this in a way that will propagate throughout the other nodes as well as maintain ownership in the new environment? The username in the new environment that will own these is different, so I assume these needs to be stored in their ../etc/users/dir??!? I know I can use the deployement server to deploy these but then they do not get the proper permissions. I think the key is to migrate /opt/splunk/etc/apps/search/local/savedsearches.conf because that seems to allow this all to be seen from the cluster.

Any help is much appreciated.

0 Karma
1 Solution

badrinath_itrs
Communicator

Hi,

Please follow below steps to push your changes.

1./opt/splunk/etc/apps/search/local/savedsearches.conf

Copy this file to a new/existing app on your Deployer ( $SPLUNK_HOME/etc/shcluster/apps) and push the change from Search Head Deployer to the members.

  1. /opt/splunk/etc/users/212059627/search/local/savedsearches.conf

You can copy this file under the appropriate user ( $SPLUNK_HOME/etc/shcluster/users) folder on your deployer and push the change from Search Head Deployer.

For search head cluster, you should not be using deployment server to push changes to your search head members.

Refer below documentation for further details.
http://docs.splunk.com/Documentation/Splunk/6.5.0/DistSearch/PropagateSHCconfigurationchanges

View solution in original post

badrinath_itrs
Communicator

Hi,

Please follow below steps to push your changes.

1./opt/splunk/etc/apps/search/local/savedsearches.conf

Copy this file to a new/existing app on your Deployer ( $SPLUNK_HOME/etc/shcluster/apps) and push the change from Search Head Deployer to the members.

  1. /opt/splunk/etc/users/212059627/search/local/savedsearches.conf

You can copy this file under the appropriate user ( $SPLUNK_HOME/etc/shcluster/users) folder on your deployer and push the change from Search Head Deployer.

For search head cluster, you should not be using deployment server to push changes to your search head members.

Refer below documentation for further details.
http://docs.splunk.com/Documentation/Splunk/6.5.0/DistSearch/PropagateSHCconfigurationchanges

brent_weaver
Builder

Thanks guys this worked!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...