Deployment Server Does Not Replace Existing Lookup CSV Files

[JanYang]

I am using the deployment server to push configurations to the search heads. All the .conf files are successfully deployed. However, the CSV files under the lookups folder are not being replaced.

If I add a new CSV file, it can be successfully pushed.

But if I try to modify an existing CSV file, the deployment does not update it on the search heads.

Could you please advise why the existing CSV files are not being replaced during deployment?

[akkoem]

is this a search head cluster or single search heads ?

[JanYang]

search head cluster ,

[akkoem]

Splunk's Best practice advises using Search Head Deployer to push applications to Search Head Cluster, However, you can still use deployment server to push your new app to Search Head Deployer , then to be pushed to SHC. 

This is important in your case, since SHD has a flag in its CLI command to preserve lookups when pushing new configuration to Search Head Cluster Members.

If you must use your Deployment server, I can advise on configuration on the DS to push your new app /shcluster-apps in the Search Head Deployer. However, starting from SHD: you would need below command to override CSVs in the Search Head:

splunk apply shcluster-bundle --target <SHC_member_URI> --preserve-lookups false

[JanYang]

When I added
[sslConfig]
cliVerifyServerName = true,
An error will appear:
ERROR: certificate validation: self signed certificate in certificate chain

Encountered some errors while trying to obtain kvstore status.
Couldn't complete HTTP request: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed

[JanYang]

I am using Deployer, maybe because my English is not good.

[PickleRick]

See

https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/9.4/update-search-head-cl...

[JanYang]

I have found the cause and successfully solved the problem. Thank you very much

[JanYang]

The following error message appeared, 

DS-01-24Next> splunk apply shcluster-bundle --target https://172.26.35.95:8089 --preserve-lookups false
Warning: Depending on the configuration changes being pushed, this command might initiate a rolling restart of the cluster members. Please refer to the documentation for the details. Do you wish to continue? [y/n]: y
WARNING: Server Certificate Hostname Validation is disabled. Please see server.conf/[sslConfig]/cliVerifyServerName for details.
Unknown parameter : -target

but I had never encountered a similar problem when I used 8.4.2 before.

Previously, I used the following commands:

splunk apply shcluster-bundle -action stage --answer-yes -auth admin:'password'
splunk apply shcluster-bundle -action send -target https://172.26.35.95:8089 --answer-yes -auth admin:'password'

[akkoem]

sorry for the double dashes, it should be single dash as your previously successful apply command:

splunk apply shcluster-bundle -action stage --answer-yes -auth admin:'password' -preserve-lookups false
splunk apply shcluster-bundle -action send -target https://172.26.35.95:8089 --answer-yes -auth admin:'password' -preserve-lookups false

Please note that this is going to override all lookups, if you have some lookup that you want to retain, move it out of the shcluster-apps directory. 

Please note that I don't use -action in my bundle push. but this should still work

[JanYang]

This still didn't work 😭

[akkoem]

is it possible that these lookups saved in private? meaning not shared globally or with app level

Settings > Lookups > Lookup table files

Then find your lookup file , check under Sharing column 

[JanYang]

I solved this problem by modifying the following conf file: deployer_lookups_push_mode = preserve_lookups

thanks