Splunk Enterprise

How to use deployer to distribute $SPLUNK_HOME/etc/system/local config files?

ndavis4
Explorer

I am trying to distribute $SPLUNK_HOME/etc/system/local/web.conf file to all my servers in my cluster with the  (search heads, management nodes, search peers). I want to change the name of my cert files from the default

privKeyPath = $SPLUNK_HOME/etc/auth/splunkweb/privkey.pem
serverCert = $SPLUNK_HOME/etc/auth/splunkweb/cert.pem

I am using the following command. 

 

 

splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

 

 


I have searched and found nothing on how to do this. Only for apps ($SPLUNK_HOME/etc/apps/)

Labels (1)
Tags (1)
0 Karma
1 Solution

yeahnah
Motivator

Hi @ndavis4 

Sorry, but this is not possible as the SHC deployer will only update apps in $SPLUNK_HOME/etc/apps/.

Some sort of automation (e.g. Ansible, Puppet) is better for this sort of config change, or as it's fairly static once changed, just work through each server and update manually.

Hope this helps


View solution in original post

yeahnah
Motivator

Hi @ndavis4 

Sorry, but this is not possible as the SHC deployer will only update apps in $SPLUNK_HOME/etc/apps/.

Some sort of automation (e.g. Ansible, Puppet) is better for this sort of config change, or as it's fairly static once changed, just work through each server and update manually.

Hope this helps


ndavis4
Explorer

This is interesting. 

https://docs.splunk.com/Documentation/Splunk/9.0.2/DistSearch/Forwardsearchheaddata

Discusses how to forward internal logs from search head cluster members. It appears to recommend using the deployer to propagate the outputs.conf file. The outputs.conf files sits in $SPLUNK_HOME/etc/system/local folder which the deployer can not propagate to. Am I reading this wrong? 

Forward data from search head cluster members

You perform the same configuration steps to forward data from search head cluster members to their set of search peers. However, you must ensure that all members use the same outputs.conf file. To do so, do not edit the file on the individual search heads. Instead, use the deployer to propagate the file across the cluster. 

0 Karma

yeahnah
Motivator

Hi @ndavis4 

Yes, it is possible to have configuration like outputs.conf pushed out via the deployer but it would still end up in an app space under SPLUNK_HOME/etc/apps, not under  SPLUNK_HOME/etc/system/local.  This is fine and would work, just watch out for any potential app and conf file precedence issues if there is more than one copy.

0 Karma

ndavis4
Explorer

Thanks. This is what I expected. No problem, it is a static change and I can make changes on each server.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...