Deployment Architecture

targetRepositoryLocation only working in global?

bmacias84
Champion

Hello I am unable to configure targetRepositoryLocation in serverclass.conf. Only seems o work in global. Is anyone else see this?

Splunk 6.0.2

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

The relevant docs don't claim targetRepositoryLocation can be overriden on the serverclass level, it's only listed in global. Are you sure this is supposed to work?

http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Serverclassconf

View solution in original post

woodcock
Esteemed Legend

There is a bug in serverclass.spec that causes Splunk Deployment Server to give the following FALSE error logs:

Checking conf files for problems...
                Invalid key in stanza [serverClass:site1_indexers] in /opt/splunk/etc/system/local/serverclass.conf, line XXX: targetRepositoryLocation  (value:  $SPLUNK_HOME/etc/master-apps).
                Invalid key in stanza [serverClass:site1_indexers] in /opt/splunk/etc/system/local/serverclass.conf, line XXX+1: targetRepositoryLocationPolicy  (value:  rejectAlways).

You can confirm that it actually works by running /opt/splunk/bin/splunk show config serverclass | grep targetRepository which will give you this (which clearly indicates functional configurations):

targetRepositoryLocation=$SPLUNK_HOME/etc/apps
targetRepositoryLocation=$SPLUNK_HOME/etc/master-apps
targetRepositoryLocationPolicy=rejectAlways

You can double-check that it should work by running /opt/splunk/bin/splunk btool serverclass list --debug| grep targetRepository which will give you this (which clearly indicates valid configurations):

/opt/splunk/etc/system/default/serverclass.conf targetRepositoryLocation = $SPLUNK_HOME/etc/apps
/opt/splunk/etc/system/local/serverclass.conf   targetRepositoryLocation = $SPLUNK_HOME/etc/master-apps
/opt/splunk/etc/system/local/serverclass.conf   targetRepositoryLocationPolicy = rejectAlways

You can also confirm by checking the target Cluster Master destination which will clearly show that it does indeed pull in CM apps to $SPLUNK_HOME/etc/apps/ as well as Indexer apps (via a different serverclass using the targetRepository* settings) to $SPLUNK_HOME/etc/master-apps/.

It is unfortunate the both the documentation and the spec files are in error. I am open a documentation updated request to get this mess cleared up.

NOTE: You may, or may not, desire the rejectAlways setting. Use it or don't; it has nothing to do with the viability of the other setting(s).

martin_mueller
SplunkTrust
SplunkTrust

The relevant docs don't claim targetRepositoryLocation can be overriden on the serverclass level, it's only listed in global. Are you sure this is supposed to work?

http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Serverclassconf

bmacias84
Champion

You are correct. This can only be done in global or on the deployment client. http://wiki.splunk.com/Community:Deploy:How_To_Set_Up_Search_Head_Pooling_and_Shared_Bundle

woodcock
Esteemed Legend

NO NO NO!!! This is INCORRECT! Please see my other answer!!!!

0 Karma

apujar
Splunk Employee
Splunk Employee

@woodcock 

#Splunk Remote Upgrader for Linux Universal Forwarders

It's not working, please see below serverclass.conf even tried by adding targetRepositoryLocationPolicy under serverClass stanza [serverClass:push_force_del_pkg_uf]

in the UF still it is copying the app under /opt/splunkforwarder/etc/apps folder but i want it to be in /tmp directory

[global]
targetRepositoryLocationPolicy = rejectAlways

[serverClass:push_upg_pkg_app:app:splunk_app_uf_remote_upgrade_linux]

[serverClass:push_upg_pkg_app]
whitelist.0 = XX.XX.XX.XX

[serverClass:push_force_del_pkg_uf]
targetRepositoryLocation = /tmp/
whitelist.0 = XX.XX.XX.XX

[serverClass:push_force_del_pkg_uf:app:SPLUNK_UPDATER_MONITORED_DIR]

 

apujar_0-1748939055714.png

 

0 Karma

yannK
Splunk Employee
Splunk Employee

if you are using the UI "forwarder management" then some settings are not supported (but they are in the configuration file)

see http://docs.splunk.com/Documentation/Splunk/6.0.2/Updating/Forwardermanagementcompatibility

0 Karma

bmacias84
Champion

@yannk, sorry I should have provided more details. I am editing the serverclass.conf file directly and i receive message that I have a typo. If I move the same line to the global stanza it works correctly.

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 3)

Welcome back to Splunk Classroom Chronicles, our ongoing blog series that pulls back the curtain on Splunk ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...