so I configured a 4 member search head cluster successfully with a captain and a deployer server however when I got to deploy a simple app such as the GlobalBanner it aint working
per this doc Use the deployer to distribute apps and configuration updates I create the following subdirectory and conf file on my Deployer server
C:\Program Files\Splunk\etc\shcluster\apps\GlobalBanner\local\global-banner.conf
and I push the bundle using this command from the Deployer server
splunk apply shcluster-bundle -target https://MySearchHeadCaptain.MyDomain.net:8089
and the file ends up in the following directory on the search head cluster members
C:\Program Files\Splunk\etc\apps\GlobalBanner\default\gloval-banner.conf
Why does it end up in the default sub folder?
My Deployer server is setup with the push mode set to full like so
[shclustering]
pass4SymmKey = $7$SoMeJuNk=
shcluster_label = shcluster1
deployer_push_mode = full
1,000 thanks to anyone who can set me straight
so good news and bad news:
Good News: the tech support guy found the problem I was shoving the deployer_push_mode = local_only setting into the wrong file etc\system\local\server.conf and it belongs in the etc\system\local\app.conf so good on him, and yes shame on me!
app.cong
[shclustering]
deployer_push_mode = local_only
Bad News: you can not enable / control the silly banner with a bundle push, yes the files get pushed to all the members but nothing happens, you need to configure the banner on one of the members (preferably the Captain) manually using the Web UI and then the automagical replication will take care of the rest
got this advice via the Splunk Documentation feedback:
"This issue sounds like a bug in the code. Have you raised the issue with Splunk Support, so that they can investigate?"
so today I opened a support case, and will keep you posted on what they find
so good news and bad news:
Good News: the tech support guy found the problem I was shoving the deployer_push_mode = local_only setting into the wrong file etc\system\local\server.conf and it belongs in the etc\system\local\app.conf so good on him, and yes shame on me!
app.cong
[shclustering]
deployer_push_mode = local_only
Bad News: you can not enable / control the silly banner with a bundle push, yes the files get pushed to all the members but nothing happens, you need to configure the banner on one of the members (preferably the Captain) manually using the Web UI and then the automagical replication will take care of the rest
Hi @Gregski11
please update deployer_push_mode = local_only
and restart deployer and push the config to members
in related news:
also I noticed if I drop a file on the Search Head Captain in the system\local subdirectory it does not get automagically replicated to the other 3 members, however if I modify the banner using the Web UI and that creates a file in the system\local subdirectory on the Captain then it does get automagically replicated to the other members, perhaps that is how it is supposed to work I don't know
thanks Sanjay
I changed the mode like you suggested and repushed the bundle with a \local subdirectory in it with a .conf file in that, and no dice, the local subdirectory does not get created on the members, it is driving me crazy