Splunk Search

Is it safe to deploy apps with lookups using the deployment server?


We're not sure whether it's safe to use the deployment server feature for all our apps, especially those with lookup files.
We want to deploy an app that has several lookup files as csv in its

directory. These apps will be rolled out to several search heads. On the search heads the csv files will be updated with data regularly.

Will there be a redeployment once the search head phones home to the deployment server, thus overwriting the csv? When and how is the check sum of the deployed app computed?


0 Karma

Path Finder

This is possible, and supported, however it will be tricky if you wish to UPDATE the lookups post deploy via the deployment server.

There is a deployment server option to exclude folders/files from updates:
excludeFromUpdate = $app_root$/lookups

This will populate the lookups directory if it doesn't exist, but if the app already has a lookups folder it will completely ignore it. If you have a single lookup file that you wish to exclude from the deployment server, you should be able to specify that particular lookup:
excludeFromUpdate = $app_root$/lookups/mylookup.csv

Hope this helps,
Jim Goddard

0 Karma


I'd say no but can't find the relevant docs right now 😞

This should be fairly easy to test though.

0 Karma