Deployment Architecture

Preparing Apps for Deployment

nce054
Path Finder

I have a deployment server that is pushing apps to multiple universal forwarders without issues. Every time that I add an app, however, I have to physically log into the machine that the deployment server resides on, and drag the app from "apps" to "deployment-apps" for it to show up on the "Forwarder Management" tab on Splunk Web. Is there an easier way to do this? I want users to be able to add their own apps to the deployment server without having to log into the actual machine and move files.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

If I am hearing you correctly, You are allowing your users to login to your DS (very bad idea, that is; I would never allow this) and install apps from apps.splunk.com. Your expectation is that, having done so, the installed app would automatically deploy to all your forwarders. Is this correct? If not, you really need to explain yourself more because to a certain degree, your question seems to be "my DS is doing what a DS is supposed to do" which doesn't make sense to me.

In any case, it is a trivial matter to write a script to compare the apps in $SPLUNK_HOME/etc/apps/ and $SPLUNK_HOME/etc/deployment-apps and synchronize them and the put this into a cron job that runs every 5 minutes.

View solution in original post

woodcock
Esteemed Legend

If I am hearing you correctly, You are allowing your users to login to your DS (very bad idea, that is; I would never allow this) and install apps from apps.splunk.com. Your expectation is that, having done so, the installed app would automatically deploy to all your forwarders. Is this correct? If not, you really need to explain yourself more because to a certain degree, your question seems to be "my DS is doing what a DS is supposed to do" which doesn't make sense to me.

In any case, it is a trivial matter to write a script to compare the apps in $SPLUNK_HOME/etc/apps/ and $SPLUNK_HOME/etc/deployment-apps and synchronize them and the put this into a cron job that runs every 5 minutes.

nce054
Path Finder

The answer that I was looking for was in your last paragraph; the thing that was bothering me was having to manually move my apps from one folder to the other. And yes, I suppose I should limit the amount of people using my DS. Thanks for the answer.

0 Karma

woodcock
Esteemed Legend

I do not think this is a good idea, especially because most apps are not intended to run on forwarders, but hey, you're the admin, right?

0 Karma

nce054
Path Finder

I appreciate your suggestions, that's for sure. I'll think on it.

0 Karma

woodcock
Esteemed Legend

Generally the apps that start with TA (enabling Technology Add-ons) are supposed to be run on forwards so maybe you just do those.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...