Splunk Search
Highlighted

Sync search head configs in 4.1

Path Finder

Hi. We are not yet ready to upgrade to 4.2, where we can use the Search Head Pooling feature.

Until we can, we still want to be able to sync /opt/splunk/etc/apps/search/local/savedsearches.conf between our several search heads.

I have searched for this in documentation, but end up with 2 questions.

  1. Can we use Deployment Server for this? The examples seem to be for Forwarders, but nothing stands out as a reason why we couldn't use it for syncing Search Heads as well.

  2. If we cannot use Deployment Server for this, is there a method of reloading config files without bouncing Splunk itself? the "splunk reload" command seems only to be for authentication reloads and Deployment Server reloads.

Thanks.

0 Karma
Highlighted

Re: Sync search head configs in 4.1

Contributor

Yes, you could use deployment server for this. Create an app with the conf files you want to deploy. Create a class in the serverclass.conf for the app, whitelist your servers and you are set.
I use deployment server to push conf's to all my Search Heads and Indexers. This way all I have to do when I stand up a new box is add the servername to the serverclass.conf under the appropriate classes and things are golden.

View solution in original post

0 Karma
Highlighted

Re: Sync search head configs in 4.1

Splunk Employee
Splunk Employee

Also, you should be able to reload saved searches by hitting this (authenticated) URL

http://SearchHead:8089/services/properties/savedsearches?refresh=true

NOTE: there is more to search head pooling than just sharing configs - for example if you have scheduled searches in search head pooling only on search head will execute a scheduled search instance. If you simply sync savedsearches.conf, each search head will execute the scheduled searches and you could end up with duplicate alerts.

0 Karma