Deployment Architecture

Why isn't calendar_heatmap_app being deployed to the SHs?

ddrillic
Ultra Champion

I deployed the out-of-the-box calendar_heatmap_app from the deployer server to the three search heads. They haven't reached /opt/splunk/etc/apps on the three SHs.

grep -i heatmap < splunkd.log on the deployer doesn't show anything. What can it be?

0 Karma
1 Solution

pradeepkumarg
Influencer

So you had the apps in deployment-apps but your command output is for a cluster. Search head cluster members are not managed via deployment apps but etc/shcluster/apps/

If your search heads are clustered. Placed the heatmap app under etc/shcluster/apps on the search head deployer and then push the bundle. It should now reach to search heads

View solution in original post

0 Karma

pradeepkumarg
Influencer

So you had the apps in deployment-apps but your command output is for a cluster. Search head cluster members are not managed via deployment apps but etc/shcluster/apps/

If your search heads are clustered. Placed the heatmap app under etc/shcluster/apps on the search head deployer and then push the bundle. It should now reach to search heads

0 Karma

ddrillic
Ultra Champion

Monday syndrome ; -)

0 Karma

pradeepkumarg
Influencer

Did you check if your bundle push command did not error out? Did it say successful ?

0 Karma

ddrillic
Ultra Champion

Right, it said - Bundle has been pushed successfully to all the cluster members.

0 Karma

pradeepkumarg
Influencer

Did you put the app in etc/shcluster/apps or etc/apps under the deployer? Any errors in conf.log /var/log/splunk/conf.log on the deployer

0 Karma

ddrillic
Ultra Champion

I placed the app under - /opt/splunk/etc/deployment-apps/.

About - /opt/splunk/var/log/splunk
$ grep -i error < conf.log

No errors since 05-12-2018.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...