Deployment Architecture

How to migrate savedsearches.conf from one search head cluster to another?

Builder

I need to migrate two savedsearches.conf files to a new search head cluster:

/opt/splunk/etc/apps/search/local/savedsearches.conf
/opt/splunk/etc/users/212059627/search/local/savedsearches.conf

How do I do this in a way that will propagate throughout the other nodes as well as maintain ownership in the new environment? The username in the new environment that will own these is different, so I assume these needs to be stored in their ../etc/users/dir??!? I know I can use the deployement server to deploy these but then they do not get the proper permissions. I think the key is to migrate /opt/splunk/etc/apps/search/local/savedsearches.conf because that seems to allow this all to be seen from the cluster.

Any help is much appreciated.

0 Karma
1 Solution

Communicator

Hi,

Please follow below steps to push your changes.

1./opt/splunk/etc/apps/search/local/savedsearches.conf

Copy this file to a new/existing app on your Deployer ( $SPLUNK_HOME/etc/shcluster/apps) and push the change from Search Head Deployer to the members.

  1. /opt/splunk/etc/users/212059627/search/local/savedsearches.conf

You can copy this file under the appropriate user ( $SPLUNK_HOME/etc/shcluster/users) folder on your deployer and push the change from Search Head Deployer.

For search head cluster, you should not be using deployment server to push changes to your search head members.

Refer below documentation for further details.
http://docs.splunk.com/Documentation/Splunk/6.5.0/DistSearch/PropagateSHCconfigurationchanges

View solution in original post

Communicator

Hi,

Please follow below steps to push your changes.

1./opt/splunk/etc/apps/search/local/savedsearches.conf

Copy this file to a new/existing app on your Deployer ( $SPLUNK_HOME/etc/shcluster/apps) and push the change from Search Head Deployer to the members.

  1. /opt/splunk/etc/users/212059627/search/local/savedsearches.conf

You can copy this file under the appropriate user ( $SPLUNK_HOME/etc/shcluster/users) folder on your deployer and push the change from Search Head Deployer.

For search head cluster, you should not be using deployment server to push changes to your search head members.

Refer below documentation for further details.
http://docs.splunk.com/Documentation/Splunk/6.5.0/DistSearch/PropagateSHCconfigurationchanges

View solution in original post

Builder

Thanks guys this worked!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!