Installation

Splunk etc app directories

dahlberg
New Member

I inherited a Splunk installation and I'm a little confused about the app directories in $SPLUNK_HOME/etc (I'm sure its probably answered in docs.splunk.com, and I've looked but I can't seem to find where this might be documented)

(1) I have both a standalone Splunk installation and an installation with a cluster manager. In each installation there is an "apps", "deployment-apps", "master-apps" and "system" directory in $SPLUNK_HOME/etc. When would I use each specific directory?

(2) Within "apps", "deployment-apps", and "master-apps", there are directories (that have the standard default/local/metadata subdirectories) called IA-appname and TA-appname where appname is something like "shibboleth" for data forwarded from Shibboleth servers. What goes in the IA dirs and what goes in the TA dirs?

(3) Is there a way (either CLI or Web GUI) to determine if the changes I've made or IA/TA subdirectories I've created have been incorporated into the Splunk configuration?

Thanks for any help/suggestions/links you can offer.

Mike

0 Karma

dhirendra761
Contributor
0 Karma

ddrillic
Ultra Champion

Because the Splunk Enterprise software package contains the Indexer, the Search Head, the Deployment Server, the Deployer and more, it gets tricky.

Therefore, it depends on the context - on the Deployment Server $SPLUNK_HOME/etc/deployment-apps contains all the apps to be distributed to the forwarders. On the Deployer Server, in a cluster, $SPLUNK_HOME/etc/shcluster/apps holds the apps to be distributed to the Search Heads. On the Search Head, $SPLUNK_HOME/etc/apps holds the apps themselves.

$SPLUNK_HOME/etc/master-apps is to distribute apps to the indexers - Manage app deployment across all peers

Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...