Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- deploy and configure apps to a cluster with heavy ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can anyone tell me the steps to deploy and configure multiple apps in a cluster with heavy forwarders.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @sam1010,
as @manjunathmeti said, on a Search Hards Cluster you can use only Deployer to deploy apps.
The steps to follow are at https://docs.splunk.com/Documentation/Splunk/8.2.1/DistSearch/PropagateSHCconfigurationchanges
in few words:
- copy your unzipepd apps on Deployer $SPLUNK_HOME/etc/shcluste/apps,
- flom CLI, run the command
splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>- beware: if your apps are already installed on the SHC, the above command overrides lookups, if you don't want to override lookups, you have to use:
splunk apply shcluster-bundle -target <URI>:<management_port> -preserve-lookups true -auth <username>:<password>
On Heavy Forwarders, as @manjunathmeti said, you can use the Deployment Server.
The steps are described at https://docs.splunk.com/Documentation/Splunk/8.2.1/Updating/Updateconfigurations
in few words:
- copy your unzipped apps at $SPLUNK_HOME/etc/deployment-apps
- wait few minutes or run
splunk reload deploy-serverOnly one attention point: if you have two or more HF to take syslogs with a front Load Balancer, in this way there could be the risk that both the HFs restart at the same time, so you lose syslogs, in this case I hint to manually install apps one HF after the other.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @sam1010,
as @manjunathmeti said, on a Search Hards Cluster you can use only Deployer to deploy apps.
The steps to follow are at https://docs.splunk.com/Documentation/Splunk/8.2.1/DistSearch/PropagateSHCconfigurationchanges
in few words:
- copy your unzipepd apps on Deployer $SPLUNK_HOME/etc/shcluste/apps,
- flom CLI, run the command
splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>- beware: if your apps are already installed on the SHC, the above command overrides lookups, if you don't want to override lookups, you have to use:
splunk apply shcluster-bundle -target <URI>:<management_port> -preserve-lookups true -auth <username>:<password>
On Heavy Forwarders, as @manjunathmeti said, you can use the Deployment Server.
The steps are described at https://docs.splunk.com/Documentation/Splunk/8.2.1/Updating/Updateconfigurations
in few words:
- copy your unzipped apps at $SPLUNK_HOME/etc/deployment-apps
- wait few minutes or run
splunk reload deploy-serverOnly one attention point: if you have two or more HF to take syslogs with a front Load Balancer, in this way there could be the risk that both the HFs restart at the same time, so you lose syslogs, in this case I hint to manually install apps one HF after the other.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@gcusello Thanks for the solution and providing relevant documentation. Is there any documentation for @manjunathmeti 's answers 2nd step as well? i.e. " 2. Deploy indexer apps from Cluster Master server to Indexer Servers/Peers in the cluster." In other words how do I carry out this step about deploying apps in indexer?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @sam1010,
Google is your best friend for searching documentation, anyway, you can find the documentation about Indexers Cluster at https://docs.splunk.com/Documentation/Splunk/8.2.1/Indexer/Manageappdeployment and at https://docs.splunk.com/Documentation/Splunk/8.2.1/Indexer/Updatepeerconfigurations
In few words, you have to:
- by CLI copy your unzipped apps in $SPLUNK_HOME/etc/master-apps,
- by GUI push the configurations.
Ciao and happy splunking.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To deploy indexer apps from cluster master:
- copy your unzipped apps on cluster master $SPLUNK_HOME/etc/master-apps
- from CLI, run the command
/opt/splunk/bin/splunk apply cluster-bundle --answer-yes -auth <username>:<password>
Once the latest bundle is deployed, apps will be stored in $SPLUNK_HOME/etc/slave-apps on indexer servers.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
1. Deploy search head apps from the Deployer server to Search Heads in the cluster.
2. Deploy indexer apps from Cluster Master server to Indexer Servers/Peers in the cluster.
3. Deploy heavy forwarder apps from Deployment server to Heavy Forwarders.
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain
