Deployment Architecture

Moving searches from default to local to be able to manage on the cluster

skirven
Communicator

Hi! I am trying to deal with some technical debt, and I thought I had an understanding of what I needed. 😞 

Objective: I have some search artifacts inside a custom app on my Search Head Deployer that once deployed, users are unable to delete. On the Deployer, those searches were in the Default folder. I did give this what I thought was a thorough reading https://docs.splunk.com/Documentation/Splunk/7.2.10/DistSearch/PropagateSHCconfigurationchanges, but I may have missed something.

What I tried:
1) Backup the app
2) Moved the contents on the Deployer Server of shcluster/apps/app_name/default/savedsearches.conf to local/savedsearches.conf
3) I updated the local/app.conf to a "deployer_push_mode = full".

What appeared to happen: It seems that it may have merged the deployer local folder into the default on the cluster, which may make sense after another spin through the document.

What's the best approach for cleaning up this app? Should I just deploy it to  my Search Head Deployer as an app, then remove the searches I want to clean up, then redeploy to the cluster?

Thanks!
Stephen

Labels (1)
0 Karma

thambisetty
Super Champion

I believe you are looking something similar to below thread:

https://community.splunk.com/t5/Deployment-Architecture/Savedsearches-in-search-app-migrating-to-SHC...

————————————
If this helps, give a like below.
0 Karma

skirven
Communicator

Thanks for the response. But I already have the app created on the Deployer Server. It's moving the searches inside the app to be able to manage them. I don't want to go through and have to make a new app. 😞

Thanks!
Stephen

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...