Hi Splunkers, I'm deploying a new Splunk Enterprise environment; inside it, I have (for now) 2 HF and a DS. I'm trying to set an outputs.conf file on both HF via DS; clients perform a correct phonin...
See more...
Hi Splunkers, I'm deploying a new Splunk Enterprise environment; inside it, I have (for now) 2 HF and a DS. I'm trying to set an outputs.conf file on both HF via DS; clients perform a correct phoning to DS, but then apps are not downloaded. I checked the internal logs and I got no error related to app. I followed doc and course material used during Architect course for references. Below, configuration I made on DS. App name: /opt/splunk/etc/deployment-apps/hf_seu_outputs/ App file /opt/splunk/etc/deployment-apps/hf_seu_outputs/default/app.conf
[ui]
is_visible = 0
[package]
id = hf_outputs
check_for_updates = 0 /opt/splunk/etc/deployment-apps/hf_seu_outputs/local/outputs.conf
[indexAndForward]
index=false
[tcpout]
defaultGroup = default-autolb-group
forwardedindex.filter.disable = true
indexAndForward = false
[tcpout:default-autolb-group]
server=<idx1_ip_address>:9997, <idx2_ip_address>:9997, <idx3_ip_address>:9997 serverclass.conf: [serverClass:spoke_hf:app:hf_seu_outputs]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:spoke_hf]
whitelist.0 = <HF1_ip_address>, <HF1_ip_address> File and folder permission are right, owner is the user used to execute Splunk (in a nutshell, the owner of /opt/spluk). I suppose it is a very stupid issue, but I'm not able to figured it out.