Splunk Enterprise

Configuration pushing using Deployment Server Globally

Reddi694325
Path Finder

Hi All,

I hope everyone doing good. 

 

I have One deployment server and around 10,000 Universal forwarders in my environment. I need to update the server.conf configuration in all(10,000) Universal forwarders under the path $Splunk_Home$ /etc/system/local/server.conf .  But when I try to deploy using app it is not deploying globally. Kindly help me with the same. 

 

Thanks & Regards,

Reddy

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

As others have said, the deployment server cannot alter or replace anything in $SPLUNK_HOME/etc/system/local.  At least not directly.

What some do is deploy an app that contains a new config file as well as a scripted input that deletes the same file in etc/system/local.  While this is usually done with deploymentclient.conf, there's no reason it can't be used with other config files.  Be careful, though, because server.conf has many more settings the deploymentclient.conf you must be very sure your new file replicates them all before deleting the system/local copy.

Once all of the forwarders are running the new config you can remove the script from the app.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ivanreis
Builder

Hi Reddy, The Deployment Server does not deploy changes to $Splunk_Home$ /etc/system/local/server.conf, all the apps by default are being deployed to $Splunk_Home$ /etc/apps/<app_name>.
The best practice is to create a new app, add the server.conf with the stanzas you need to update into the app and deploy it to one server for testing purposes. Avoid change/update the default files to prevent from service disruption or mismatch configuration. It’s recommended to run this test in a dev or sandbox environment to make sure this change will work as expected and it will not cause any issues to the production. If this help you to fix your issues, please give a like.

isoutamo
SplunkTrust
SplunkTrust

There is also “trick” how to remove those from system local folder after you have installed new app to replace that. @richgalloway or @gcusello probably could give to you exact instructions?

r. Ismo

0 Karma

thambisetty
Super Champion

can you test deploying app to one universal forwarder ( create metadata directory inside app and create a file called local.meta content should be like below)

[]

export = system

after deploying, use btool to check whether this configuration is taking precedence over the one inside system local.

 

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...