Splunk Enterprise

How to use deployer to distribute $SPLUNK_HOME/etc/system/local config files?

ndavis4
Explorer

I am trying to distribute $SPLUNK_HOME/etc/system/local/web.conf file to all my servers in my cluster with the  (search heads, management nodes, search peers). I want to change the name of my cert files from the default

privKeyPath = $SPLUNK_HOME/etc/auth/splunkweb/privkey.pem
serverCert = $SPLUNK_HOME/etc/auth/splunkweb/cert.pem

I am using the following command. 

 

 

splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

 

 


I have searched and found nothing on how to do this. Only for apps ($SPLUNK_HOME/etc/apps/)

Labels (1)
Tags (1)
0 Karma
1 Solution

yeahnah
Motivator

Hi @ndavis4 

Sorry, but this is not possible as the SHC deployer will only update apps in $SPLUNK_HOME/etc/apps/.

Some sort of automation (e.g. Ansible, Puppet) is better for this sort of config change, or as it's fairly static once changed, just work through each server and update manually.

Hope this helps


View solution in original post

yeahnah
Motivator

Hi @ndavis4 

Sorry, but this is not possible as the SHC deployer will only update apps in $SPLUNK_HOME/etc/apps/.

Some sort of automation (e.g. Ansible, Puppet) is better for this sort of config change, or as it's fairly static once changed, just work through each server and update manually.

Hope this helps


ndavis4
Explorer

This is interesting. 

https://docs.splunk.com/Documentation/Splunk/9.0.2/DistSearch/Forwardsearchheaddata

Discusses how to forward internal logs from search head cluster members. It appears to recommend using the deployer to propagate the outputs.conf file. The outputs.conf files sits in $SPLUNK_HOME/etc/system/local folder which the deployer can not propagate to. Am I reading this wrong? 

Forward data from search head cluster members

You perform the same configuration steps to forward data from search head cluster members to their set of search peers. However, you must ensure that all members use the same outputs.conf file. To do so, do not edit the file on the individual search heads. Instead, use the deployer to propagate the file across the cluster. 

0 Karma

yeahnah
Motivator

Hi @ndavis4 

Yes, it is possible to have configuration like outputs.conf pushed out via the deployer but it would still end up in an app space under SPLUNK_HOME/etc/apps, not under  SPLUNK_HOME/etc/system/local.  This is fine and would work, just watch out for any potential app and conf file precedence issues if there is more than one copy.

0 Karma

ndavis4
Explorer

Thanks. This is what I expected. No problem, it is a static change and I can make changes on each server.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...