Deployment Architecture

deployment from SH

MAMAOUI
Explorer

Hi All,

Is there a way to make deployments from SH without going through CM?
and how we can do it? What settings do we have to change or to configure for deploying?

Thanks
M&A

0 Karma
1 Solution

gcusello
Legend

HI MAMAOUI,
are you speaking about deployment of apps to Search Heads or deployment of TAs to Universal Forwarders?

If the first, if you have a Search Head Cluster you must use Deployer to Deploy Apps to SH, if you haven't a Search Head Cluster you can deploy Apps manually or using a Deployment Server, but I'd prefer to manually perform this to have more control on apps ad updates.

If instead you're speaking of deployment of TAs to Universal Forwarder, you have to use a Deployment Server, that must be a dedicated system if you have to manage more than 50 Forwarders.

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
Legend

HI MAMAOUI,
are you speaking about deployment of apps to Search Heads or deployment of TAs to Universal Forwarders?

If the first, if you have a Search Head Cluster you must use Deployer to Deploy Apps to SH, if you haven't a Search Head Cluster you can deploy Apps manually or using a Deployment Server, but I'd prefer to manually perform this to have more control on apps ad updates.

If instead you're speaking of deployment of TAs to Universal Forwarder, you have to use a Deployment Server, that must be a dedicated system if you have to manage more than 50 Forwarders.

Bye.
Giuseppe

0 Karma

MAMAOUI
Explorer

Hi Giuseppe,
So, how can I deploy Apps manually ?
Thanks

MAMAOUI

0 Karma

gcusello
Legend

HI MAMAOUI,
if you have a Search Head Cluster, you have to deploy apps using deployer
https://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/PropagateSHCconfigurationchanges
in few words, you have to copy your apps to deploy in Deployer's $SPLUNK_HOME/etc/shcluster/ and then Push the configuration bundle running the command

./splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

if you want to preserve lookups of the other apps you have to use

splunk apply shcluster-bundle -target <URI>:<management_port> -preserve-lookups true -auth <username>:<password>

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Timecharts look like very flat

<span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Jennifer_0-1656485114286.png" ...

Why getting timeout error while adding data to the Splunk cloud index from REST API?

Hello Team,<BR /><BR />I am getting timeout error while adding data to Splunk cloud index from REST API. I am ...

Cannot push config from deployer to search head cluster

Hello,I recently upgraded our deployer/deployment server from 8.1.6 to version 9.0 and when I try to push ...