Deployment Architecture

Replicating/Copying files within Splunk SH Cluster members

Path Finder


We require your help implementing a part of solution for an app deployed in our Splunk SH cluster. The app is pushed to all the SH members using a deployer.

The App contains a script which downloads IoCs and deposits in the location “$SPLUNK_HOME/etc/apps/app_name/appserver/static“ so that our other Security solutions can access it via HTTP(S). The App is designed to download only in SH captain. This part works very well.

However we need a logic to copy/replicate the IOC files in /app_name/appserver/static (in captain) to other member servers too. The files in this location are CSV and JSON. Our goal is to access these files from remote location via web, If these files are kept updated in all peers then we can access it from any member server irrespective of which one is the actual captain node. Is there a way we can achieve this using Splunk only? We know this can be done using scp/share folder but client wants to do this within Splunk. Any help is appreciated.

0 Karma

Ultra Champion

Are lookups not automatically synced between SH members? - Could you create you file in ./lookups?

I think the fact that you are using app/static will prevent the run time replication - if you can move it to lookups, I think Splunk will handle it for you.

If my comment helps, please give it a thumbs up!
0 Karma

Path Finder

Hi Nick,

We are keeping the files in the static folder so that these can accessed via http.

In our other security solutions we can just point the IOC location as http://splunkserver:8000/static/app/ app_name/IOCfilename.csv

If we move the files to lookups folder then we loose this facility.

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...