Splunk Enterprise

Deploying DB Connect in a search head cluster.

cdevoe57
Path Finder

I have a splunk distributed system with 3 indexers, 3 search heads, a manger, and 2 heavy forwarders.  I am attempting to deploy the DB Connect application to the HF and the SHC.  The SHC has 3 member nodes and the deployer on the manger node.  Ideally, this would all be done with ansible, sadly, the deployer gets in the way.  I can deploy to the HF with ansible, but the deployer keeps removing the db connect app on the SHC.

That said, to deploy I install the app on the manager node, install the drivers, and then copy it to the ...shcluster/apps directory  and run the splunk schcluster apply command.   I've done this both manually and using ansible.   When I run the apply the deployer does not put the entire app on the search heads, it only puts the default and metadata directories on the Search heads in the splunk_app_db_connect directory.   

When I go into the manage  apps on the GUI I see the app installed but it is not visible.  I would prefer not to use the GUI for management and perform all management task via the cli and ansible.  The code is stored in a version control system and gives not only control over the deployments but also trakcs who did what, when, why, and how.

 

So I guess there are multiple questions. 

  1.  Why is the deployer not pushing the entire application to the search heads?
  2. How can I disable the deployer and just use ansible?
Labels (3)
0 Karma

karl_lbg
Loves-to-Learn

When using a Deployer, the default push mode is merge_to_default.  So most likely is that it is merging local configs into default of the deployed app when it lands on the SH targets.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You can't mix different distribution methods. If you're using ansible, use it to deploy to the deployer - that's the way to manage the SHC. What the deployer pushes depends on the push mode.

0 Karma

cdevoe57
Path Finder

Yes, I use ansible to push the app to the deployer.    Then from within ansible I run the splunk apply shcluster.  

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Then check your push mode. If you want to push everything as is, you have to set it to "full" for this app.

0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...