Splunk Search

Sync search head configs in 4.1

Sqig
Path Finder

Hi. We are not yet ready to upgrade to 4.2, where we can use the Search Head Pooling feature.

Until we can, we still want to be able to sync /opt/splunk/etc/apps/search/local/savedsearches.conf between our several search heads.

I have searched for this in documentation, but end up with 2 questions.

  1. Can we use Deployment Server for this? The examples seem to be for Forwarders, but nothing stands out as a reason why we couldn't use it for syncing Search Heads as well.

  2. If we cannot use Deployment Server for this, is there a method of reloading config files without bouncing Splunk itself? the "splunk reload" command seems only to be for authentication reloads and Deployment Server reloads.

Thanks.

0 Karma
1 Solution

JSapienza
Contributor

Yes, you could use deployment server for this. Create an app with the conf files you want to deploy. Create a class in the serverclass.conf for the app, whitelist your servers and you are set.
I use deployment server to push conf's to all my Search Heads and Indexers. This way all I have to do when I stand up a new box is add the servername to the serverclass.conf under the appropriate classes and things are golden.

View solution in original post

0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

Also, you should be able to reload saved searches by hitting this (authenticated) URL

http://SearchHead:8089/services/properties/savedsearches?refresh=true

NOTE: there is more to search head pooling than just sharing configs - for example if you have scheduled searches in search head pooling only on search head will execute a scheduled search instance. If you simply sync savedsearches.conf, each search head will execute the scheduled searches and you could end up with duplicate alerts.

0 Karma

JSapienza
Contributor

Yes, you could use deployment server for this. Create an app with the conf files you want to deploy. Create a class in the serverclass.conf for the app, whitelist your servers and you are set.
I use deployment server to push conf's to all my Search Heads and Indexers. This way all I have to do when I stand up a new box is add the servername to the serverclass.conf under the appropriate classes and things are golden.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...