Importing .SPL project into Search head cluestering

[dhawal_sanghvi]

Hi Splunk Experts,
Need a clarrification - I have a .SPL file (contains artifacts, saved search, dashboards, macros, lookups,etc) extracted and exported from a stand alone search head (SH) box. Now, I want to import the file in to Search Head Clustering? Where should I load/import the .SPL file? Is it on the the deployer (OR) Captain (OR) Search Head Member (OR) Search Head Load Balancer so that the custom apps created are replicated on all the search head clustering? Please assist.

[adonio · Accepted solution]

Hello dhawal_sanghvi,
will recommend to upload the file to the Deployer, that will untar the file and place the correct directories in .../etc/apps. make sure the app is working. Now just copy it from .../etc/apps to .../etc/shcluster/apps and deploy to Search Head Cluster Members
If the app has searches that runs against same indexers, will disable it on the Deployer after it works on Cluster Members to reduce load and avoid multiple alerts / scheduled searches / reports etc.
Hope it helps

[adonio]

Hello dhawal_sanghvi,
will recommend to upload the file to the Deployer, that will untar the file and place the correct directories in .../etc/apps. make sure the app is working. Now just copy it from .../etc/apps to .../etc/shcluster/apps and deploy to Search Head Cluster Members
Hope it helps

[hardikJsheth]

I agree with @adonio

[dhawal_sanghvi]

Hi,
Just a follow up if I understood correctly

1. Upload .spl file to the deployer from the web portal
2. Verify the app is working.
3. Then copy the data from .../etc/apps to .../etc/shcluster/apps in the deployer server
4. Deploy to search head cluster members by running the command in the deployer server as ./splunk apply shcluster-bundle -target https://XXX.XX.XX.XXX:8089 -auth username:password
5. Validate on the SHC members and the Splunk web if the app is shown.

Please correct!!

Thanks,
Dhawal

[adonio]

yes that is correct,
if your app has searches that runs against the indexers, disable the app on the deployer as a last step
if it works, please accept answer to close the question
cheers