Deployment Architecture

Using Splunk deployment server to deploy apps to index master

brent_weaver
Builder

I would like to know if it is possible to use the splunk deployment server to manage index apps (.../etc/master-apps). There is a param in deploymentclient.conf:

repositoryLocation = $SPLUNK_HOME/etc/apps
* The location into which content is installed after being downloaded from a
  deployment server.
* Apps and configuration content must be installed into the default location
  ($SPLUNK_HOME/etc/apps) or it will not be recognized by
  the Splunk instance on the deployment client.
    * Note: Apps and configuration content to be deployed may be located in
      an alternate location on the deployment server. Set both
      repositoryLocation and serverRepositoryLocationPolicy explicitly to
      ensure that the content is installed into the correct location
      ($SPLUNK_HOME/etc/apps) on the deployment clientr
    * The deployment client uses the 'serverRepositoryLocationPolicy'
      defined below to determine which value of repositoryLocation to use.

This does not seem to work. I realize that I will need to still perform a bundle push.

Any thoughts are welcome!

0 Karma

brent_weaver
Builder

I am just going to stick with my original plan to just use ansible to manage index cluster apps.

0 Karma

kcepull2
Path Finder

@dkeck: You need to add "stateOnClient = noop" to either the [serverClass:xxx] or [serverClass:xxx:app:yyy] stanzas to tell the Deployment Server to NOT try to "activate" the app once it is pushed to the Cluster Master. Since the apps are put in master-apps on the CM, they aren't active on the CM itself, so you don't want the DS trying to enable them. That should get rid of the errors you are seeing about "failed to install".

dkeck
Influencer

Ok I see.

Is there a better way to managed this? I really don´t want to add this stanza everytime I add an new app, and I don´t want to add this to 20+ serverclasses I already have.

Maybe the better way is, to disable deployment for CM.

0 Karma

woodcock
Esteemed Legend

Read what he said; you can put it in the parent section and then it will apply to all apps.

0 Karma

MuS
SplunkTrust
SplunkTrust

As mentioned before, use another tool to do this like Chef, Puppet or .... even scp or rsync can do the job.

0 Karma

gjanders
SplunkTrust
SplunkTrust

kcepull2's solution will work, and yes it's per application, you could try to minimize the number of applications you deploy to your cluster master.

Many Splunk applications need only to be on the search head cluster and/or heavy forwarder, only some have index-time props/transforms/indexes configuration.
For these you also have the option of putting the configuration into a common application...

Also MuS's solution is of course valid as well...if you prefer that path...(apetite by bridgewater would be yet another product you could use)

0 Karma

dkeck
Influencer

Hi, I get that this may not be best way, but I implemented that the Cluster Master will get its apps from the Deploymentserver.

    repositoryLocation = $SPLUNK_HOME/etc/master-apps
serverRepositoryLocationPolicy = rejectAlways

This worked fine at the beginning, but know I get errors like:

 ERROR DeployedServerclass - name=test_app Failed to install app=test_app   
 ERROR DeployedApplication - Failed to install app=/opt/splunk/etc/master-apps/test_app; reason=Application does not exist: test_app

I read some old answers, that this could be a bug, since this is the most recent one, I hoped, that someone could tell me more about this.

Is this resolved? Should it work like this?

Kind Regards

Thank you

David

0 Karma

MuS
SplunkTrust
SplunkTrust

Yes, you can do such a thing with deployment client. It will put the apps into the repositoryLocation and that's it.
As you correctly mentioned the apply cluster-bundle must be done separately.

But, being able to do something and actually do it are two different things and I would not use deployment client function to copy apps onto the cluster master (my personal opinion). If possible use a different tool like Puppet or Chef or what ever is able to copy files into place and run a command afterwards for you.
And just to add, please don't use Puppet or alike to deploy configs directly to the cluster members 😉

cheers, MuS

nickhills
Ultra Champion

Just another +1
Just because you can do something, does not mean you should

Deployment Servers Manage Forwarders
Deployers Manage Search Head Clusters
Cluster Masters Manage Search Clusters
Only (even if you can technically)

Ask me how i know!

If my comment helps, please give it a thumbs up!
0 Karma

brent_weaver
Builder

Thank you for this info! I agree and haev resorted to using ansible to deploy apps to the master-apps dir, and then force a bundle push.

Thanks!

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

As @MuS says, dont push directly to the index peers. This bad practice. I have customers using automation to push to the master-apps folder on the Master Node, and then you can use rest or CLI to push the cluster bundles out.

Pushing these individually to indexers can cause numerous problems, including configurations being out of sync, invalid configuration errors causing Splunk not to start, and other issues that may manifest is bizaar ways that are not easy to troubleshoot...

0 Karma

MuS
SplunkTrust
SplunkTrust

The reason I added this comment was at the SplunkTrust AMA at .conf 2017 some one asked why he gets all these weird errors when he puts the cluster configs on the peers using puppet 😉
The response was an in unison NO! and of course the SplunkTrust explained then why this should not be done.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...