Splunk Enterprise Security

Does Git Version Control for Splunk support Search Head cluster?

FrankVl
Ultra Champion

Installation instructions do not mention anything specific to using this Git Version Control for Splunk app in a Search Head cluster setup. Is that supported and if so are there any specific things to keep in mind?

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @FrankVl

Yes, this app will work on a SHC.

First, decide if you want to track changes on just one search head or if you want to track changes on all search heads. In theory all search heads should be the same so it is up to you if you want to track changes on all of them.
For any search heads where you are going to run this, you will need to manually SSH onto the box and run the git initalization commands.
If you are going to run on one search head, you need to put the app configuration into system/local/
If you are using multiple search heads you can push the app configuration from the SH deployer.
In both cases you will push the git_for_splunk app from the SH deployer as normal.

You might need to slightly alter the out-of-the-box dashboards.

All the best,
Chris.

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @FrankVl

Yes, this app will work on a SHC.

First, decide if you want to track changes on just one search head or if you want to track changes on all search heads. In theory all search heads should be the same so it is up to you if you want to track changes on all of them.
For any search heads where you are going to run this, you will need to manually SSH onto the box and run the git initalization commands.
If you are going to run on one search head, you need to put the app configuration into system/local/
If you are using multiple search heads you can push the app configuration from the SH deployer.
In both cases you will push the git_for_splunk app from the SH deployer as normal.

You might need to slightly alter the out-of-the-box dashboards.

All the best,
Chris.

0 Karma

FrankVl
Ultra Champion

Thanks for the quick response Chris. We'll give it a go in a test environment first anyway, but good to hear that it should work and thanks for the specific pointers.

0 Karma

harshpatel
Contributor

Maybe asking the owner of the app might help. Try creating https://github.com/ChrisYounger/git_for_splunk github issue here.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...