Deployment Architecture

What is the process of moving locally installed app to a deployment server?

Path Finder


I have inherited a set of splunk servers, and three are search heads.  Some of the apps on the search heads  are installed directly.  I would prefer to manage those apps from the deployment server.  

I have found lots of information about deploying apps via single-instance/distributed, but not a lot on how to move an app from a single instance to a deployment server.

In my brain, the procedure looks like this:

  1. On the search head, tar up the app from $SPLUNK/etc/apps/<appname>
  2. copy the tar file to the deployment server
  3. untar the file into the $SPLUNK/etc/deployment-apps
  4. uninstall or disable the original app on the original searchhead
  5. Map the new  app to serverclass and to the client system (original search head)

Is this correct? 




Labels (2)
0 Karma


@jason0  - 

You can certainly do it, SH requires deploymentclient.conf file pointing to (deployment server)DS. 

I never tested after the first-time deployment of apps  from DS --> SH, the subsequent changes to the apps done locally by user will stay on SH.. however if you push the same app once again from  DS might get override the app on SH which might remove the local changes.

Where as with SH deployer they get merged with local changes!

Path Finder

Hello venkatasri, 

Thank you for your reply.

Here's the interesting point of note: these search heads (not an SHC) are already managed by a deployment server.   The SH also happen to have individually installed apps.  i want to pull those apps into the deployment server because I dislike snowflake systems.

So if I understand your note correctly, it is not clear what will happen to the local changes on the SH when the deployment server first deploys the (recently moved) app.   it sounds like I need to experiment.

After re-reading your response, I went to find the difference between SH deployer vs deployment server, and found the following link: looks like I have more learning to do...  🙂



0 Karma
Get Updates on the Splunk Community!

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...