Splunk Dev

How does search head clustering refer to python files in this case?

kimch330
Engager

i have search head A and B and C.
it is search head clustering structure.

i modified $SPLUNK_HOME/etc/apps/custom_apps/lib/connect.py from search head C and restartss to search head C only.

i think change and applied from search head C only.

but, search head A and B together change and applied

my questions mean I modified Search Head C directly without using deployer, but why does it work? and How does search head clustering refer to python files in this case?

Labels (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kimch330

I don't think any python file which is modified through backend will replicate. In such changes, you should go with the deployer. Deployer will take care of that.

The changes that the cluster replicates

These are the main types of configuration changes that the cluster replicates:

  • Runtime changes or additions to knowledge objects, such as saved searches, lookup tables, and dashboards. For example, when a user in Splunk Web defines a field extraction, the cluster replicates that field extraction to all search heads in the cluster.
  • Runtime changes to users and roles. See Add users to the search head cluster.

Please check the below document for more information about replication.

https://docs.splunk.com/Documentation/Splunk/8.0.3/DistSearch/HowconfrepoworksinSHC

Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...