Deployment Architecture

Why am I unable to migrate custom settings in the default Search app from a standalone search head to members of a search head cluster?

nibinabr
Communicator

I'm trying to migrate the custom settings in the default search app in a standalone SH to the cluster members in a Search Head Custer and I'm following this documentation.
http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/Migratefromstandalonesearchheads

I created an app called search_migration_app and copied the contents of the local directory (from the search app) to the this app. I also created the local.meta file under the metadata directory in search_migration_app and added the configs to export the settings globally.

Once I push this app from the deployer, the search heads contains the search_migration_app directory with only an app.conf file under the default folder and a default.meta inside the metadata folder. I can't find any objects that I'm trying to migrate.

Any idea what is happening here? May be I'm missing something simple here.

Any help is appreciated.

jkat54
SplunkTrust
SplunkTrust

You are using a search head deployer NOT the deployment server correct?

You should be placing the search_migration_app in the $SPLUNK_HOME/etc/shcluster/apps directory on the SH deployer and not in the $SPLUNK_HOME/var/run/splunk/deploy directory on the SH Deployer.

You should also be copying the previous /etc/users directory into $SPLUNK_HOME/etc/shcluster/users directory on the SH Deployer.

Another gotcha is if you copied as root but splunk runs as another user... or the files otherwise have bad permissions.

Please perform an ls -al $SPLUNK_HOME/etc/shcluster/* on your SH Deployer and post the results here.

hemendralodhi
Contributor

I have to perform the same task in next few days and I was thinking of following the same procedure as outlined in docs. As per doc:

All files placed under both default and local subdirectories get merged into default subdirectories on the members, post-deployment. All your object should be in the search_migration_app. You can check on deployer at this location what it is trying to push and if it contains all your object for this app $SPLUNK_HOME/var/run/splunk/deploy

I just read doc and giving you info which you have already followed. Just giving input in blind and looking for answer as I will face the same thing in future.

If it is resolved, please let us know.

Thanks

0 Karma

nibinabr
Communicator

In my $SPLUNK_HOME/var/run/splunk/deploy, I see the search_migration_app with an empty default folder. The apps also has a metadata folder with default.meta containing configs to export the settings globally.

May be a workaround is to copy the local directory from the search app (in the standalone SH) and place it in the local directory for the search app in cluster members. However I don't want to do it this way because 1) Not the splunk recommended way of doing it. 2) I want to assign the responsibility of managing these configs to the deployer.

0 Karma

hemendralodhi
Contributor

As you confirmed that in deploy default folder is empty this means some thing is wrong at start. Did you untar the app before deploying it? Also can you double check if search_migration_app is having all objects before running the command. Are you placing the app correctly in deployer location?

I am sure you have followed all this but I have no idea until I implement the same in next few days.

Can someone pitch in and advise?

Thanks

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...