Splunk Enterprise Security

How to create custom app/addon(steps) using CLI and push to SHC members using deployer

obais9346
Engager

I am a Advanced beginner to splunk and i want to create custom app/addon in my search head cluster environment and push via deployer to all shc members

Note: We have GUI disabled in our environment to create apps/addons through shc members

Also how can i place app and tar and untar app/addon in shcluster/apps directory and push to shc members via deployer.

Please help with steps for best practice

Labels (1)
0 Karma
1 Solution

aasabatini
Motivator

Hi @obais9346 

  I suggest to use this very helpful app "Splunk add-on builder" and try the apps or add-on on a test enviroment.

https://splunkbase.splunk.com/app/2962/

When you tested your add-on or app you can put on the Deployer  in $Splunk_Home/etc/shcluster/apps directory, so you need to manually copy the app to that directory. 

run this comand

 

 

splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

 

 

for more details there is the documentation

https://docs.splunk.com/Documentation/Splunk/8.1.3/DistSearch/PropagateSHCconfigurationchanges

let me know if you need more informations

Alessandro

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

View solution in original post

Tags (2)

obais9346
Engager

Thanks helped me

0 Karma

obais9346
Engager

Thank you for this information, but i have read this document, i am mainly looking for creating app/addon(installing on search head members) and deploying via CLI through deployer without add on builder.

 

https://docs.splunk.com/Documentation/Splunk/8.1.3/DistSearch/PropagateSHCconfigurationchanges

 

i have read this too

appreciate your help 

0 Karma

aasabatini
Motivator

Hi @obais9346 

  I suggest to use this very helpful app "Splunk add-on builder" and try the apps or add-on on a test enviroment.

https://splunkbase.splunk.com/app/2962/

When you tested your add-on or app you can put on the Deployer  in $Splunk_Home/etc/shcluster/apps directory, so you need to manually copy the app to that directory. 

run this comand

 

 

splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

 

 

for more details there is the documentation

https://docs.splunk.com/Documentation/Splunk/8.1.3/DistSearch/PropagateSHCconfigurationchanges

let me know if you need more informations

Alessandro

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Tags (2)
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...