Splunk Enterprise

Question on a Splunk Searchhead app and distsearch.conf

skirven
Communicator

Hi! I am looking to try to standardize my configuration across my Search Head Cluster. I have 15 Search Heads, and what I am looking to to is move my etc/system/local configs to a searchhead app (let's call it etc/apps/searchhead). 

 

Looking at my files, most of them should be fine, but I was wondering about the syntax for the distsearch.conf lookups. What I have now is like: lkp1 = apps/idm_search/lookups/lkpInterceptAttempt.csv

Would that same path find the file when the file is in /opt/splunk/etc/apps/searchhead/distsearch.conf? Or do I have to be more explicit about it's location?

Thanks!
Stephen

Labels (1)
0 Karma

skirven
Communicator

Bump. Also, I've been researching this, and it looks like it's best practice just to put it in $SPLUNK_HOME/etc/system/local? What's the best practice to keep that up to date? I was hoping to be able to have all of the configurations pushed from the deployer once it's been connected?

Any insight would be appreciated!
Stephen

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...