Splunk Search

Sync search head configs in 4.1

Sqig
Path Finder

Hi. We are not yet ready to upgrade to 4.2, where we can use the Search Head Pooling feature.

Until we can, we still want to be able to sync /opt/splunk/etc/apps/search/local/savedsearches.conf between our several search heads.

I have searched for this in documentation, but end up with 2 questions.

  1. Can we use Deployment Server for this? The examples seem to be for Forwarders, but nothing stands out as a reason why we couldn't use it for syncing Search Heads as well.

  2. If we cannot use Deployment Server for this, is there a method of reloading config files without bouncing Splunk itself? the "splunk reload" command seems only to be for authentication reloads and Deployment Server reloads.

Thanks.

0 Karma
1 Solution

JSapienza
Contributor

Yes, you could use deployment server for this. Create an app with the conf files you want to deploy. Create a class in the serverclass.conf for the app, whitelist your servers and you are set.
I use deployment server to push conf's to all my Search Heads and Indexers. This way all I have to do when I stand up a new box is add the servername to the serverclass.conf under the appropriate classes and things are golden.

View solution in original post

0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

Also, you should be able to reload saved searches by hitting this (authenticated) URL

http://SearchHead:8089/services/properties/savedsearches?refresh=true

NOTE: there is more to search head pooling than just sharing configs - for example if you have scheduled searches in search head pooling only on search head will execute a scheduled search instance. If you simply sync savedsearches.conf, each search head will execute the scheduled searches and you could end up with duplicate alerts.

0 Karma

JSapienza
Contributor

Yes, you could use deployment server for this. Create an app with the conf files you want to deploy. Create a class in the serverclass.conf for the app, whitelist your servers and you are set.
I use deployment server to push conf's to all my Search Heads and Indexers. This way all I have to do when I stand up a new box is add the servername to the serverclass.conf under the appropriate classes and things are golden.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...