We are facing very strange issue as the objects of specific Apps reverted back to old settings even the lookup files were impacted on our SHC this issue repeated more than once since upgrading Splunk to v 9.0.4
Can you please help on this case ?
Hi
What you are actually meaning with "the objects of specific Apps reverted back to old settings"?
Old lookups are in use, old KOs are in use after you apply shcluster-bundle on deployer?
It that then yo should read and check these:
r. Ismo
There are no miracles.
Something must have been changed by someone.
1. Use btool to see where the settings come from
2. Check the config tracker to see when there were changes made to your environment. https://www.splunk.com/en_us/blog/platform/splunking-your-conf-files-how-to-audit-configuration-chan...
Thanks Pickle,
The config tracker was pretty useful as I found the following settings in app.conf file (deployer_push_mode&install_source_local_checksum) have been changed to new value then got reverted to old value and also found "deployer_push_mode=full" then deleted from some SHC members meanwhile "deployer_push_mode=full" is set on the deployer in app.conf file of the app