Deployment Architecture

Simple Global Banner Search Head Cluster Bundle Push Not Working As Expected

Gregski11
Contributor

so I configured a 4 member search head cluster successfully with a captain and a deployer server however when I got to deploy a simple app such as the GlobalBanner it aint working

per this doc Use the deployer to distribute apps and configuration updates  I create the following subdirectory and conf file on my Deployer server

C:\Program Files\Splunk\etc\shcluster\apps\GlobalBanner\local\global-banner.conf

 

and I push the bundle using this command from the Deployer server

splunk apply shcluster-bundle -target https://MySearchHeadCaptain.MyDomain.net:8089

 

and the file ends up in the following directory on the search head cluster members

C:\Program Files\Splunk\etc\apps\GlobalBanner\default\gloval-banner.conf

Why does it end up in the default sub folder?

 

My Deployer server is setup with the push mode set to full like so 

[shclustering]
pass4SymmKey = $7$SoMeJuNk=
shcluster_label = shcluster1
deployer_push_mode = full

 

1,000 thanks to anyone who can set me straight

Labels (1)
Tags (1)
0 Karma
1 Solution

Gregski11
Contributor

so good news and bad news:

Good News: the tech support guy found the problem I was shoving the deployer_push_mode = local_only setting into the wrong file etc\system\local\server.conf and it belongs in the etc\system\local\app.conf so good on him, and yes shame on me!

app.cong
[shclustering]
deployer_push_mode = local_only

 

Bad News: you can not enable / control the silly banner with a bundle push, yes the files get pushed to all the members but nothing happens, you need to configure the banner on one of the members (preferably the Captain) manually using the Web UI and then the automagical replication will take care of the rest

View solution in original post

0 Karma

Gregski11
Contributor

got this advice via the Splunk Documentation feedback:


"This issue sounds like a bug in the code. Have you raised the issue with Splunk Support, so that they can investigate?" 

 

so today I opened a support case, and will keep you posted on what they find

 

0 Karma

Gregski11
Contributor

so good news and bad news:

Good News: the tech support guy found the problem I was shoving the deployer_push_mode = local_only setting into the wrong file etc\system\local\server.conf and it belongs in the etc\system\local\app.conf so good on him, and yes shame on me!

app.cong
[shclustering]
deployer_push_mode = local_only

 

Bad News: you can not enable / control the silly banner with a bundle push, yes the files get pushed to all the members but nothing happens, you need to configure the banner on one of the members (preferably the Captain) manually using the Web UI and then the automagical replication will take care of the rest

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @Gregski11 

please update deployer_push_mode = local_only

and restart deployer and push the config to members 

0 Karma

Gregski11
Contributor

in related news:

also I noticed if I drop a file on the Search Head Captain in the system\local subdirectory it does not get automagically replicated to the other 3 members, however if I modify the banner using the Web UI and that creates a file in the system\local subdirectory on the Captain then it does get automagically replicated to the other members, perhaps that is how it is supposed to work I don't know

0 Karma

Gregski11
Contributor

thanks Sanjay 

I changed the mode like you suggested and repushed the bundle with a \local subdirectory in it with a .conf file in that, and no dice, the local subdirectory does not get created on the members, it is driving me crazy

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...