Splunk Enterprise

How to use deployer to distribute $SPLUNK_HOME/etc/system/local config files?

ndavis4
Explorer

I am trying to distribute $SPLUNK_HOME/etc/system/local/web.conf file to all my servers in my cluster with the  (search heads, management nodes, search peers). I want to change the name of my cert files from the default

privKeyPath = $SPLUNK_HOME/etc/auth/splunkweb/privkey.pem
serverCert = $SPLUNK_HOME/etc/auth/splunkweb/cert.pem

I am using the following command. 

 

 

splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

 

 


I have searched and found nothing on how to do this. Only for apps ($SPLUNK_HOME/etc/apps/)

Labels (1)
Tags (1)
0 Karma
1 Solution

yeahnah
Motivator

Hi @ndavis4 

Sorry, but this is not possible as the SHC deployer will only update apps in $SPLUNK_HOME/etc/apps/.

Some sort of automation (e.g. Ansible, Puppet) is better for this sort of config change, or as it's fairly static once changed, just work through each server and update manually.

Hope this helps


View solution in original post

yeahnah
Motivator

Hi @ndavis4 

Sorry, but this is not possible as the SHC deployer will only update apps in $SPLUNK_HOME/etc/apps/.

Some sort of automation (e.g. Ansible, Puppet) is better for this sort of config change, or as it's fairly static once changed, just work through each server and update manually.

Hope this helps


ndavis4
Explorer

This is interesting. 

https://docs.splunk.com/Documentation/Splunk/9.0.2/DistSearch/Forwardsearchheaddata

Discusses how to forward internal logs from search head cluster members. It appears to recommend using the deployer to propagate the outputs.conf file. The outputs.conf files sits in $SPLUNK_HOME/etc/system/local folder which the deployer can not propagate to. Am I reading this wrong? 

Forward data from search head cluster members

You perform the same configuration steps to forward data from search head cluster members to their set of search peers. However, you must ensure that all members use the same outputs.conf file. To do so, do not edit the file on the individual search heads. Instead, use the deployer to propagate the file across the cluster. 

0 Karma

yeahnah
Motivator

Hi @ndavis4 

Yes, it is possible to have configuration like outputs.conf pushed out via the deployer but it would still end up in an app space under SPLUNK_HOME/etc/apps, not under  SPLUNK_HOME/etc/system/local.  This is fine and would work, just watch out for any potential app and conf file precedence issues if there is more than one copy.

0 Karma

ndavis4
Explorer

Thanks. This is what I expected. No problem, it is a static change and I can make changes on each server.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

[Coming Soon] Splunk Observability Cloud - Enhanced navigation with a modern look and ...

We are excited to introduce our enhanced UI that brings together AppDynamics and Splunk Observability. This is ...

Splunk Smartness with Patrick Tatro | Episode 4

Welcome to another episode of "Splunk Smartness," where we explore how Splunk Education can revolutionize your ...