Splunk Dev

How does search head clustering refer to python files in this case?

kimch330
Engager

i have search head A and B and C.
it is search head clustering structure.

i modified $SPLUNK_HOME/etc/apps/custom_apps/lib/connect.py from search head C and restartss to search head C only.

i think change and applied from search head C only.

but, search head A and B together change and applied

my questions mean I modified Search Head C directly without using deployer, but why does it work? and How does search head clustering refer to python files in this case?

Labels (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kimch330

I don't think any python file which is modified through backend will replicate. In such changes, you should go with the deployer. Deployer will take care of that.

The changes that the cluster replicates

These are the main types of configuration changes that the cluster replicates:

  • Runtime changes or additions to knowledge objects, such as saved searches, lookup tables, and dashboards. For example, when a user in Splunk Web defines a field extraction, the cluster replicates that field extraction to all search heads in the cluster.
  • Runtime changes to users and roles. See Add users to the search head cluster.

Please check the below document for more information about replication.

https://docs.splunk.com/Documentation/Splunk/8.0.3/DistSearch/HowconfrepoworksinSHC

Thanks

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...