Deployment Architecture

setup.xml not supported on search head cluster?

mmarkleybac
Engager

I've built a modular alert with a setup.xml to create credentials on the storage/passwords endpoint and to store a setting in local/app.conf. Everything works as expected on my standalone test system.

When I deploy it to a search head cluster (7.3.2) via the deployer, the "Set up" link doesn't show next to the app in "Manage Apps". I can navigate to the setup page manually (/en-US/manager//apps/local//setup?action=edit) and save the settings, but the local/app.conf doesn't replicate to the other members of my search head cluster. I'm thinking of testing a custom endpoint for the config piece instead of putting it into app.conf, but I don't want to go too far down this road if I'm taking the wrong approach.

Is setup.xml not supported on a search head cluster environment? How about making changes to local/app.conf? I have to assume modular alerts in general are.

0 Karma
1 Solution

adonio
Ultra Champion

as a rule of thumb, apps that require setup are first to be set up on the Deployer (or any other instance), then copy the relevant directory (app) to the shcluster/apps directory and push from there.

View solution in original post

0 Karma

adonio
Ultra Champion

as a rule of thumb, apps that require setup are first to be set up on the Deployer (or any other instance), then copy the relevant directory (app) to the shcluster/apps directory and push from there.

0 Karma

mmarkleybac
Engager

Interesting; I couldn't find that in the docs, but it makes sense, especially with the deployer_push_mode I see popped up in 7.x (my cluster was built on 6.6). Thanks.

0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...