Reporting

Creating reports in one SHC member will cause issue to other SHC members?

maniu1609
Path Finder

Hi All,
We have three search heads members. Now I'm creating a report for an custom app from a SHC member. So it created a local directory for that app in that SHC member. and the changes are also replicated to all other SHC. Now I'm afraid of the changes I made.
Since it created local directory, Content in default directory will get affected?

0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi @maniu1609,

When you create any knowledge objects in splunk search head it always stores in local directory. This is to prevent default settings and when you upgrade any application it will not overwrite your knowledge objects config which you have created from Splunk Web.

Now in splunk local directory has higher precedence then default directory. Let's understand with example, let's say you have one scheduled search test_search and in default directory savedsearches.conf contains index=abc | table host,sourcetype. Now you will change this schedule search from Splunk Web and you will change query to index=abc | stats count by host this sconfiguration will store in local directory of app so in future when this schedule search will run it will run index=abc | stats count by host from local directory not default because local directory has higher precedence than default directory.

If you want to keep your configuration in default directory on all SHC member due to process/requirement then you need to add configuration in your app on Deployer and you need to push bundle from Deployer to all SHC members everytime.

I hope this helps.

Thanks,
Harshil

View solution in original post

harsmarvania57
Ultra Champion

Hi @maniu1609,

When you create any knowledge objects in splunk search head it always stores in local directory. This is to prevent default settings and when you upgrade any application it will not overwrite your knowledge objects config which you have created from Splunk Web.

Now in splunk local directory has higher precedence then default directory. Let's understand with example, let's say you have one scheduled search test_search and in default directory savedsearches.conf contains index=abc | table host,sourcetype. Now you will change this schedule search from Splunk Web and you will change query to index=abc | stats count by host this sconfiguration will store in local directory of app so in future when this schedule search will run it will run index=abc | stats count by host from local directory not default because local directory has higher precedence than default directory.

If you want to keep your configuration in default directory on all SHC member due to process/requirement then you need to add configuration in your app on Deployer and you need to push bundle from Deployer to all SHC members everytime.

I hope this helps.

Thanks,
Harshil

hardikJsheth
Motivator

All the changes that you do to the dashboards on search head will automatically get replicated to others search head nodes in your search head cluster.

You can refer following docs for further information.
https://www.google.co.in/url?sa=t&rct=j&q=&esrc=s&source=web&cd=3&ved=0ahUKEwjVt6Di6PTXAhULVbwKHaTLA...

Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...