Deployment Architecture

What is the impact of a search head cluster deployer failure, and how do I fix the problem?

Steve_G_
Splunk Employee
Splunk Employee

What problems arise if the deployer fails, and how important is it that I bring up a new deployer immediately? And how do I bring up a new deployer?

1 Solution

Steve_G_
Splunk Employee
Splunk Employee

While the deployer is down, you cannot deploy configuration bundle updates, such as apps, to the search head cluster members. Because all cluster members must use the same set of configurations, you must, with few exceptions, ensure that a member does not join or rejoin the cluster while the deployer is down.

If no member joins the cluster and you have no immediate need to push any new configurations, the cluster can continue to operate without a deployer indefinitely.

Otherwise, you must bring up a new deployer before a member joins or rejoins the cluster:

  1. Create a new deployer instance.
  2. Restore the contents of $SPLUNK_HOME/etc/shcluster to the new instance from backup.
  3. If necessary, update the conf_deploy_fetch_url values on all search head cluster members.
  4. Push the restored bundle contents to all members by running the splunk apply shcluster-bundle command.

For details, see http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/PropagateSHCconfigurationchanges#Conseq...

View solution in original post

Steve_G_
Splunk Employee
Splunk Employee

While the deployer is down, you cannot deploy configuration bundle updates, such as apps, to the search head cluster members. Because all cluster members must use the same set of configurations, you must, with few exceptions, ensure that a member does not join or rejoin the cluster while the deployer is down.

If no member joins the cluster and you have no immediate need to push any new configurations, the cluster can continue to operate without a deployer indefinitely.

Otherwise, you must bring up a new deployer before a member joins or rejoins the cluster:

  1. Create a new deployer instance.
  2. Restore the contents of $SPLUNK_HOME/etc/shcluster to the new instance from backup.
  3. If necessary, update the conf_deploy_fetch_url values on all search head cluster members.
  4. Push the restored bundle contents to all members by running the splunk apply shcluster-bundle command.

For details, see http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/PropagateSHCconfigurationchanges#Conseq...

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...