Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Importing .SPL project into Search head cluesterin...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Splunk Experts,
Need a clarrification - I have a .SPL file (contains artifacts, saved search, dashboards, macros, lookups,etc) extracted and exported from a stand alone search head (SH) box. Now, I want to import the file in to Search Head Clustering? Where should I load/import the .SPL file? Is it on the the deployer (OR) Captain (OR) Search Head Member (OR) Search Head Load Balancer so that the custom apps created are replicated on all the search head clustering? Please assist.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello dhawal_sanghvi,
will recommend to upload the file to the Deployer, that will untar the file and place the correct directories in .../etc/apps. make sure the app is working. Now just copy it from .../etc/apps to .../etc/shcluster/apps and deploy to Search Head Cluster Members
If the app has searches that runs against same indexers, will disable it on the Deployer after it works on Cluster Members to reduce load and avoid multiple alerts / scheduled searches / reports etc.
Hope it helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello dhawal_sanghvi,
will recommend to upload the file to the Deployer, that will untar the file and place the correct directories in .../etc/apps. make sure the app is working. Now just copy it from .../etc/apps to .../etc/shcluster/apps and deploy to Search Head Cluster Members
If the app has searches that runs against same indexers, will disable it on the Deployer after it works on Cluster Members to reduce load and avoid multiple alerts / scheduled searches / reports etc.
Hope it helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello dhawal_sanghvi,
will recommend to upload the file to the Deployer, that will untar the file and place the correct directories in .../etc/apps. make sure the app is working. Now just copy it from .../etc/apps to .../etc/shcluster/apps and deploy to Search Head Cluster Members
Hope it helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I agree with @adonio
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Just a follow up if I understood correctly
- Upload .spl file to the deployer from the web portal
- Verify the app is working.
- Then copy the data from .../etc/apps to .../etc/shcluster/apps in the deployer server
- Deploy to search head cluster members by running the command in the deployer server as ./splunk apply shcluster-bundle -target https://XXX.XX.XX.XXX:8089 -auth username:password
- Validate on the SHC members and the Splunk web if the app is shown.
Please correct!!
Thanks,
Dhawal
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes that is correct,
if your app has searches that runs against the indexers, disable the app on the deployer as a last step
if it works, please accept answer to close the question
cheers
Tech Talk Recap | Mastering Threat Hunting
Observability for AI Applications: Troubleshooting Latency
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
