How to use deployer to distribute $SPLUNK_HOME/etc/system/local config files?

[ndavis4]

I am trying to distribute $SPLUNK_HOME/etc/system/local/web.conf file to all my servers in my cluster with the  (search heads, management nodes, search peers). I want to change the name of my cert files from the default

privKeyPath = $SPLUNK_HOME/etc/auth/splunkweb/privkey.pem
serverCert = $SPLUNK_HOME/etc/auth/splunkweb/cert.pem

I am using the following command. 

splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

I have searched and found nothing on how to do this. Only for apps ($SPLUNK_HOME/etc/apps/)

[yeahnah · Accepted solution]

Hi @ndavis4 

Sorry, but this is not possible as the SHC deployer will only update apps in $SPLUNK_HOME/etc/apps/.

Some sort of automation (e.g. Ansible, Puppet) is better for this sort of config change, or as it's fairly static once changed, just work through each server and update manually.

Hope this helps

[ndavis4]

This is interesting. 

https://docs.splunk.com/Documentation/Splunk/9.0.2/DistSearch/Forwardsearchheaddata

Discusses how to forward internal logs from search head cluster members. It appears to recommend using the deployer to propagate the outputs.conf file. The outputs.conf files sits in $SPLUNK_HOME/etc/system/local folder which the deployer can not propagate to. Am I reading this wrong? 

Forward data from search head cluster members

You perform the same configuration steps to forward data from search head cluster members to their set of search peers. However, you must ensure that all members use the same outputs.conf file. To do so, do not edit the file on the individual search heads. Instead, use the deployer to propagate the file across the cluster. 

[yeahnah]

Hi @ndavis4 

Yes, it is possible to have configuration like outputs.conf pushed out via the deployer but it would still end up in an app space under SPLUNK_HOME/etc/apps, not under  SPLUNK_HOME/etc/system/local.  This is fine and would work, just watch out for any potential app and conf file precedence issues if there is more than one copy.

[ndavis4]

Thanks. This is what I expected. No problem, it is a static change and I can make changes on each server.