Deployment Architecture

Importing .SPL project into Search head cluestering

dhawal_sanghvi
New Member

Hi Splunk Experts,
Need a clarrification - I have a .SPL file (contains artifacts, saved search, dashboards, macros, lookups,etc) extracted and exported from a stand alone search head (SH) box. Now, I want to import the file in to Search Head Clustering? Where should I load/import the .SPL file? Is it on the the deployer (OR) Captain (OR) Search Head Member (OR) Search Head Load Balancer so that the custom apps created are replicated on all the search head clustering? Please assist.

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

Hello dhawal_sanghvi,
will recommend to upload the file to the Deployer, that will untar the file and place the correct directories in .../etc/apps. make sure the app is working. Now just copy it from .../etc/apps to .../etc/shcluster/apps and deploy to Search Head Cluster Members
If the app has searches that runs against same indexers, will disable it on the Deployer after it works on Cluster Members to reduce load and avoid multiple alerts / scheduled searches / reports etc.
Hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

Hello dhawal_sanghvi,
will recommend to upload the file to the Deployer, that will untar the file and place the correct directories in .../etc/apps. make sure the app is working. Now just copy it from .../etc/apps to .../etc/shcluster/apps and deploy to Search Head Cluster Members
If the app has searches that runs against same indexers, will disable it on the Deployer after it works on Cluster Members to reduce load and avoid multiple alerts / scheduled searches / reports etc.
Hope it helps

0 Karma

adonio
Ultra Champion

Hello dhawal_sanghvi,
will recommend to upload the file to the Deployer, that will untar the file and place the correct directories in .../etc/apps. make sure the app is working. Now just copy it from .../etc/apps to .../etc/shcluster/apps and deploy to Search Head Cluster Members
Hope it helps

0 Karma

hardikJsheth
Motivator

I agree with @adonio

0 Karma

dhawal_sanghvi
New Member

Hi,
Just a follow up if I understood correctly

  1. Upload .spl file to the deployer from the web portal
  2. Verify the app is working.
  3. Then copy the data from .../etc/apps to .../etc/shcluster/apps in the deployer server
  4. Deploy to search head cluster members by running the command in the deployer server as ./splunk apply shcluster-bundle -target https://XXX.XX.XX.XXX:8089 -auth username:password
  5. Validate on the SHC members and the Splunk web if the app is shown.

Please correct!!

Thanks,
Dhawal

0 Karma

adonio
Ultra Champion

yes that is correct,
if your app has searches that runs against the indexers, disable the app on the deployer as a last step
if it works, please accept answer to close the question
cheers

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...