Splunk SH Cluster Reversion

[HassanElDesouky]

We are facing very strange issue as the objects of specific Apps reverted back to old settings even the lookup files were impacted on our SHC this issue repeated more than once since upgrading Splunk to v 9.0.4

Can you please help on this case ?

[isoutamo]

Hi

What you are actually  meaning with "the objects of specific Apps reverted back to old settings"?

Old lookups are in use, old KOs are in use after you apply shcluster-bundle on deployer?

It that then yo should read and check these:

• Choose a deployer push mode
• [shclustering]

r. Ismo

[HassanElDesouky]

What I mean by "revert certain application objects back to old settings", is that we noticed that 4 applications were reverted to the old version and the objects affected are dashboards, saved searches, search files, porpos.conf and transfroms.conf

For example: We configured alert  to run every 2 minutes, then changed it to run every 5 minutes, and after the issue it was switched back to run every 2 minutes

The last bundle was pushed from the deployer server on November 7th and the issue occurred on November 10th

[PickleRick]

There are no miracles.

Something must have been changed by someone.

1. Use btool to see where the settings come from

2. Check the config tracker to see when there were changes made to your environment. https://www.splunk.com/en_us/blog/platform/splunking-your-conf-files-how-to-audit-configuration-chan...

[HassanElDesouky]

Thanks Pickle,

The config tracker was pretty useful as I found the following settings in app.conf file (deployer_push_mode&install_source_local_checksum) have been changed to new value then got reverted to old value and also found "deployer_push_mode=full" then deleted from some SHC members  meanwhile "deployer_push_mode=full" is set on the deployer in app.conf file of the app