Deployment Architecture

Preparing Apps for Deployment

nce054
Path Finder

I have a deployment server that is pushing apps to multiple universal forwarders without issues. Every time that I add an app, however, I have to physically log into the machine that the deployment server resides on, and drag the app from "apps" to "deployment-apps" for it to show up on the "Forwarder Management" tab on Splunk Web. Is there an easier way to do this? I want users to be able to add their own apps to the deployment server without having to log into the actual machine and move files.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

If I am hearing you correctly, You are allowing your users to login to your DS (very bad idea, that is; I would never allow this) and install apps from apps.splunk.com. Your expectation is that, having done so, the installed app would automatically deploy to all your forwarders. Is this correct? If not, you really need to explain yourself more because to a certain degree, your question seems to be "my DS is doing what a DS is supposed to do" which doesn't make sense to me.

In any case, it is a trivial matter to write a script to compare the apps in $SPLUNK_HOME/etc/apps/ and $SPLUNK_HOME/etc/deployment-apps and synchronize them and the put this into a cron job that runs every 5 minutes.

View solution in original post

woodcock
Esteemed Legend

If I am hearing you correctly, You are allowing your users to login to your DS (very bad idea, that is; I would never allow this) and install apps from apps.splunk.com. Your expectation is that, having done so, the installed app would automatically deploy to all your forwarders. Is this correct? If not, you really need to explain yourself more because to a certain degree, your question seems to be "my DS is doing what a DS is supposed to do" which doesn't make sense to me.

In any case, it is a trivial matter to write a script to compare the apps in $SPLUNK_HOME/etc/apps/ and $SPLUNK_HOME/etc/deployment-apps and synchronize them and the put this into a cron job that runs every 5 minutes.

nce054
Path Finder

The answer that I was looking for was in your last paragraph; the thing that was bothering me was having to manually move my apps from one folder to the other. And yes, I suppose I should limit the amount of people using my DS. Thanks for the answer.

0 Karma

woodcock
Esteemed Legend

I do not think this is a good idea, especially because most apps are not intended to run on forwarders, but hey, you're the admin, right?

0 Karma

nce054
Path Finder

I appreciate your suggestions, that's for sure. I'll think on it.

0 Karma

woodcock
Esteemed Legend

Generally the apps that start with TA (enabling Technology Add-ons) are supposed to be run on forwards so maybe you just do those.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...