Deployment Architecture

Where to create a new app when using Search Head Clustering?

a212830
Champion

Hi,

In Splunk 6.2, when using SHC, where do I create a new app? It looks like new packaged apps should be done by the deployer, but what about just creating apps on the search-head? Can that be done directly on the search-head?

0 Karma

Steve_G_
Splunk Employee
Splunk Employee

In search head clustering, you must use the deployer to push any non-default apps to the search heads. You cannot install apps directly on the individual search heads.

Where you initially create and test the app, pre-deployment, is your call. As esix_splunk suggests, the best approach is to do so on a standalone search head.

For more information on pushing apps via the deployer, see http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/PropagateSHCconfigurationchanges

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Best practices are to create your app on a standalone search head, and once you have it created and configured, use the deployer to push it out to the Cluster.

a212830
Champion

I can't just create it on the deployer? I'm not talking about a fully functional app - basically just a template for customers to begin adding reports/dashboards.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You can create it on the deployer. But consider for it to be pushed out to the SHC members, it has to be moved from the $splunk_home/etc/apps to the $splunk_hom/etc/shcluster folder on the deployer, and then deployed.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...