Deployment Architecture

Why am I unable to migrate custom settings in the default Search app from a standalone search head to members of a search head cluster?

nibinabr
Communicator

I'm trying to migrate the custom settings in the default search app in a standalone SH to the cluster members in a Search Head Custer and I'm following this documentation.
http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/Migratefromstandalonesearchheads

I created an app called search_migration_app and copied the contents of the local directory (from the search app) to the this app. I also created the local.meta file under the metadata directory in search_migration_app and added the configs to export the settings globally.

Once I push this app from the deployer, the search heads contains the search_migration_app directory with only an app.conf file under the default folder and a default.meta inside the metadata folder. I can't find any objects that I'm trying to migrate.

Any idea what is happening here? May be I'm missing something simple here.

Any help is appreciated.

jkat54
SplunkTrust
SplunkTrust

You are using a search head deployer NOT the deployment server correct?

You should be placing the search_migration_app in the $SPLUNK_HOME/etc/shcluster/apps directory on the SH deployer and not in the $SPLUNK_HOME/var/run/splunk/deploy directory on the SH Deployer.

You should also be copying the previous /etc/users directory into $SPLUNK_HOME/etc/shcluster/users directory on the SH Deployer.

Another gotcha is if you copied as root but splunk runs as another user... or the files otherwise have bad permissions.

Please perform an ls -al $SPLUNK_HOME/etc/shcluster/* on your SH Deployer and post the results here.

hemendralodhi
Contributor

I have to perform the same task in next few days and I was thinking of following the same procedure as outlined in docs. As per doc:

All files placed under both default and local subdirectories get merged into default subdirectories on the members, post-deployment. All your object should be in the search_migration_app. You can check on deployer at this location what it is trying to push and if it contains all your object for this app $SPLUNK_HOME/var/run/splunk/deploy

I just read doc and giving you info which you have already followed. Just giving input in blind and looking for answer as I will face the same thing in future.

If it is resolved, please let us know.

Thanks

0 Karma

nibinabr
Communicator

In my $SPLUNK_HOME/var/run/splunk/deploy, I see the search_migration_app with an empty default folder. The apps also has a metadata folder with default.meta containing configs to export the settings globally.

May be a workaround is to copy the local directory from the search app (in the standalone SH) and place it in the local directory for the search app in cluster members. However I don't want to do it this way because 1) Not the splunk recommended way of doing it. 2) I want to assign the responsibility of managing these configs to the deployer.

0 Karma

hemendralodhi
Contributor

As you confirmed that in deploy default folder is empty this means some thing is wrong at start. Did you untar the app before deploying it? Also can you double check if search_migration_app is having all objects before running the command. Are you placing the app correctly in deployer location?

I am sure you have followed all this but I have no idea until I implement the same in next few days.

Can someone pitch in and advise?

Thanks

0 Karma
Get Updates on the Splunk Community!

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...

Explore the Latest Educational Offerings from Splunk (November Releases)

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...