deployment from SH

[MAMAOUI]

Hi All,

Is there a way to make deployments from SH without going through CM?
and how we can do it? What settings do we have to change or to configure for deploying?

Thanks
M&A

[gcusello · Accepted solution]

HI MAMAOUI,
are you speaking about deployment of apps to Search Heads or deployment of TAs to Universal Forwarders?

If the first, if you have a Search Head Cluster you must use Deployer to Deploy Apps to SH, if you haven't a Search Head Cluster you can deploy Apps manually or using a Deployment Server, but I'd prefer to manually perform this to have more control on apps ad updates.

If instead you're speaking of deployment of TAs to Universal Forwarder, you have to use a Deployment Server, that must be a dedicated system if you have to manage more than 50 Forwarders.

Bye.
Giuseppe

[MAMAOUI]

Hi Giuseppe,
So, how can I deploy Apps manually ?
Thanks

MAMAOUI

[gcusello]

HI MAMAOUI,
if you have a Search Head Cluster, you have to deploy apps using deployer
https://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/PropagateSHCconfigurationchanges
in few words, you have to copy your apps to deploy in Deployer's $SPLUNK_HOME/etc/shcluster/ and then Push the configuration bundle running the command

./splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

if you want to preserve lookups of the other apps you have to use

splunk apply shcluster-bundle -target <URI>:<management_port> -preserve-lookups true -auth <username>:<password>

Bye.
Giuseppe