If the configuration I wanted to distribute to the indexer slaves is not targeted to ../slave-apps, how should it be done, then?
The conf I'm trying to distribute is web.conf with below setting
[settings]
startwebservice = 0
The cluster master will put it on ../etc/slave-apps, not on ../etc/apps
Thank you in advance.
Hi morethanyell,
put your config in this directory:
$SPLUNK_HOME/etc/master-apps/_cluster/local
Read more about it here https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Updatepeerconfigurations#On_the_master
This will still be in slave-apps
on the peers but has the highest precedence.
I'm not aware of any Splunk configuration method for an index cluster that will put configs from etc/master_apps
into etc/apps
.
Hope this helps ...
cheers, MuS
Hi morethanyell,
put your config in this directory:
$SPLUNK_HOME/etc/master-apps/_cluster/local
Read more about it here https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Updatepeerconfigurations#On_the_master
This will still be in slave-apps
on the peers but has the highest precedence.
I'm not aware of any Splunk configuration method for an index cluster that will put configs from etc/master_apps
into etc/apps
.
Hope this helps ...
cheers, MuS
Does that mean if I create an app, let say called "system_wide_configs" and put web.conf in its /local directory, use the CM to distribute it to slave-apps, it will still work?
Theoretical Implementation:
it will then create ../etc/apps/slave-apps/system_wide_configs/local/web.conf to all the indexers, right?
Will Splunk be able to read it still?
Yep, that's the way it works.
Either config files only in the master_apps/_cluster/local
directory OR an app like you described it in master_apps/
cheers, MuS
thank you. My thinking was right after all