Replicating/Copying files within Splunk SH Cluster members

[ramesh_babu71]

Hello,

We require your help implementing a part of solution for an app deployed in our Splunk SH cluster. The app is pushed to all the SH members using a deployer.

The App contains a script which downloads IoCs and deposits in the location “$SPLUNK_HOME/etc/apps/app_name/appserver/static“ so that our other Security solutions can access it via HTTP(S). The App is designed to download only in SH captain. This part works very well.

However we need a logic to copy/replicate the IOC files in /app_name/appserver/static (in captain) to other member servers too. The files in this location are CSV and JSON. Our goal is to access these files from remote location via web, If these files are kept updated in all peers then we can access it from any member server irrespective of which one is the actual captain node. Is there a way we can achieve this using Splunk only? We know this can be done using scp/share folder but client wants to do this within Splunk. Any help is appreciated.

[nickhills]

Are lookups not automatically synced between SH members? - Could you create you file in ./lookups?
http://docs.splunk.com/Documentation/Splunk/7.0.1/DistSearch/HowconfigurationworksinSHC

I think the fact that you are using app/static will prevent the run time replication - if you can move it to lookups, I think Splunk will handle it for you.

[ramesh_babu71]

Hi Nick,

We are keeping the files in the static folder so that these can accessed via http.

In our other security solutions we can just point the IOC location as http://splunkserver:8000/static/app/ app_name/IOCfilename.csv

If we move the files to lookups folder then we loose this facility.