Deployment Architecture

deployment from SH

MAMAOUI
Explorer

Hi All,

Is there a way to make deployments from SH without going through CM?
and how we can do it? What settings do we have to change or to configure for deploying?

Thanks
M&A

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

HI MAMAOUI,
are you speaking about deployment of apps to Search Heads or deployment of TAs to Universal Forwarders?

If the first, if you have a Search Head Cluster you must use Deployer to Deploy Apps to SH, if you haven't a Search Head Cluster you can deploy Apps manually or using a Deployment Server, but I'd prefer to manually perform this to have more control on apps ad updates.

If instead you're speaking of deployment of TAs to Universal Forwarder, you have to use a Deployment Server, that must be a dedicated system if you have to manage more than 50 Forwarders.

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI MAMAOUI,
are you speaking about deployment of apps to Search Heads or deployment of TAs to Universal Forwarders?

If the first, if you have a Search Head Cluster you must use Deployer to Deploy Apps to SH, if you haven't a Search Head Cluster you can deploy Apps manually or using a Deployment Server, but I'd prefer to manually perform this to have more control on apps ad updates.

If instead you're speaking of deployment of TAs to Universal Forwarder, you have to use a Deployment Server, that must be a dedicated system if you have to manage more than 50 Forwarders.

Bye.
Giuseppe

0 Karma

MAMAOUI
Explorer

Hi Giuseppe,
So, how can I deploy Apps manually ?
Thanks

MAMAOUI

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI MAMAOUI,
if you have a Search Head Cluster, you have to deploy apps using deployer
https://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/PropagateSHCconfigurationchanges
in few words, you have to copy your apps to deploy in Deployer's $SPLUNK_HOME/etc/shcluster/ and then Push the configuration bundle running the command

./splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

if you want to preserve lookups of the other apps you have to use

splunk apply shcluster-bundle -target <URI>:<management_port> -preserve-lookups true -auth <username>:<password>

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...