System-wide conf on Indexer Slaves

[morethanyell]

If the configuration I wanted to distribute to the indexer slaves is not targeted to ../slave-apps, how should it be done, then?

The conf I'm trying to distribute is web.conf with below setting

[settings]
startwebservice = 0

The cluster master will put it on ../etc/slave-apps, not on ../etc/apps

Thank you in advance.

[MuS · Accepted solution]

Hi morethanyell,

put your config in this directory:

$SPLUNK_HOME/etc/master-apps/_cluster/local

Read more about it here https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Updatepeerconfigurations#On_the_master

This will still be in slave-apps on the peers but has the highest precedence.
I'm not aware of any Splunk configuration method for an index cluster that will put configs from etc/master_apps into etc/apps.

Hope this helps ...

cheers, MuS

[morethanyell]

Does that mean if I create an app, let say called "system_wide_configs" and put web.conf in its /local directory, use the CM to distribute it to slave-apps, it will still work?

Theoretical Implementation:

1. Create system_wide_configs/local/web.conf
2. Put it in CM's ../etc/master-apps
3. apply cluster bundle
4. perform a rolling restart

it will then create ../etc/apps/slave-apps/system_wide_configs/local/web.conf to all the indexers, right?

Will Splunk be able to read it still?

[MuS]

Yep, that's the way it works.

Either config files only in the master_apps/_cluster/local directory OR an app like you described it in master_apps/

cheers, MuS

[morethanyell]

thank you. My thinking was right after all