Deployment Architecture

setup.xml not supported on search head cluster?

mmarkleybac
Engager

I've built a modular alert with a setup.xml to create credentials on the storage/passwords endpoint and to store a setting in local/app.conf. Everything works as expected on my standalone test system.

When I deploy it to a search head cluster (7.3.2) via the deployer, the "Set up" link doesn't show next to the app in "Manage Apps". I can navigate to the setup page manually (/en-US/manager//apps/local//setup?action=edit) and save the settings, but the local/app.conf doesn't replicate to the other members of my search head cluster. I'm thinking of testing a custom endpoint for the config piece instead of putting it into app.conf, but I don't want to go too far down this road if I'm taking the wrong approach.

Is setup.xml not supported on a search head cluster environment? How about making changes to local/app.conf? I have to assume modular alerts in general are.

0 Karma
1 Solution

adonio
Ultra Champion

as a rule of thumb, apps that require setup are first to be set up on the Deployer (or any other instance), then copy the relevant directory (app) to the shcluster/apps directory and push from there.

View solution in original post

0 Karma

adonio
Ultra Champion

as a rule of thumb, apps that require setup are first to be set up on the Deployer (or any other instance), then copy the relevant directory (app) to the shcluster/apps directory and push from there.

0 Karma

mmarkleybac
Engager

Interesting; I couldn't find that in the docs, but it makes sense, especially with the deployer_push_mode I see popped up in 7.x (my cluster was built on 6.6). Thanks.

0 Karma
Get Updates on the Splunk Community!

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...