Deployment Architecture

Moving searches from default to local to be able to manage on the cluster

skirven
Path Finder

Hi! I am trying to deal with some technical debt, and I thought I had an understanding of what I needed. 😞 

Objective: I have some search artifacts inside a custom app on my Search Head Deployer that once deployed, users are unable to delete. On the Deployer, those searches were in the Default folder. I did give this what I thought was a thorough reading https://docs.splunk.com/Documentation/Splunk/7.2.10/DistSearch/PropagateSHCconfigurationchanges, but I may have missed something.

What I tried:
1) Backup the app
2) Moved the contents on the Deployer Server of shcluster/apps/app_name/default/savedsearches.conf to local/savedsearches.conf
3) I updated the local/app.conf to a "deployer_push_mode = full".

What appeared to happen: It seems that it may have merged the deployer local folder into the default on the cluster, which may make sense after another spin through the document.

What's the best approach for cleaning up this app? Should I just deploy it to  my Search Head Deployer as an app, then remove the searches I want to clean up, then redeploy to the cluster?

Thanks!
Stephen

Labels (1)
0 Karma

thambisetty
Super Champion

I believe you are looking something similar to below thread:

https://community.splunk.com/t5/Deployment-Architecture/Savedsearches-in-search-app-migrating-to-SHC...

————————————
If this helps, give a like below.
0 Karma

skirven
Path Finder

Thanks for the response. But I already have the app created on the Deployer Server. It's moving the searches inside the app to be able to manage them. I don't want to go through and have to make a new app. 😞

Thanks!
Stephen

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!