- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk etc app directories
I inherited a Splunk installation and I'm a little confused about the app directories in $SPLUNK_HOME/etc (I'm sure its probably answered in docs.splunk.com, and I've looked but I can't seem to find where this might be documented)
(1) I have both a standalone Splunk installation and an installation with a cluster manager. In each installation there is an "apps", "deployment-apps", "master-apps" and "system" directory in $SPLUNK_HOME/etc. When would I use each specific directory?
(2) Within "apps", "deployment-apps", and "master-apps", there are directories (that have the standard default/local/metadata subdirectories) called IA-appname and TA-appname where appname is something like "shibboleth" for data forwarded from Shibboleth servers. What goes in the IA dirs and what goes in the TA dirs?
(3) Is there a way (either CLI or Web GUI) to determine if the changes I've made or IA/TA subdirectories I've created have been incorporated into the Splunk configuration?
Thanks for any help/suggestions/links you can offer.
Mike
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Go-tourgh this link https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Because the Splunk Enterprise software package contains the Indexer, the Search Head, the Deployment Server, the Deployer and more, it gets tricky.
Therefore, it depends on the context - on the Deployment Server $SPLUNK_HOME/etc/deployment-apps
contains all the apps to be distributed to the forwarders. On the Deployer Server, in a cluster, $SPLUNK_HOME/etc/shcluster/apps
holds the apps to be distributed to the Search Heads. On the Search Head, $SPLUNK_HOME/etc/apps
holds the apps themselves.
$SPLUNK_HOME/etc/master-apps
is to distribute apps to the indexers - Manage app deployment across all peers
