Splunk Enterprise Security

How to create custom app/addon(steps) using CLI and push to SHC members using deployer

obais9346
Engager

I am a Advanced beginner to splunk and i want to create custom app/addon in my search head cluster environment and push via deployer to all shc members

Note: We have GUI disabled in our environment to create apps/addons through shc members

Also how can i place app and tar and untar app/addon in shcluster/apps directory and push to shc members via deployer.

Please help with steps for best practice

Labels (1)
0 Karma
1 Solution

aasabatini
Motivator

Hi @obais9346 

  I suggest to use this very helpful app "Splunk add-on builder" and try the apps or add-on on a test enviroment.

https://splunkbase.splunk.com/app/2962/

When you tested your add-on or app you can put on the Deployer  in $Splunk_Home/etc/shcluster/apps directory, so you need to manually copy the app to that directory. 

run this comand

 

 

splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

 

 

for more details there is the documentation

https://docs.splunk.com/Documentation/Splunk/8.1.3/DistSearch/PropagateSHCconfigurationchanges

let me know if you need more informations

Alessandro

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

View solution in original post

Tags (2)

obais9346
Engager

Thanks helped me

0 Karma

obais9346
Engager

Thank you for this information, but i have read this document, i am mainly looking for creating app/addon(installing on search head members) and deploying via CLI through deployer without add on builder.

 

https://docs.splunk.com/Documentation/Splunk/8.1.3/DistSearch/PropagateSHCconfigurationchanges

 

i have read this too

appreciate your help 

0 Karma

aasabatini
Motivator

Hi @obais9346 

  I suggest to use this very helpful app "Splunk add-on builder" and try the apps or add-on on a test enviroment.

https://splunkbase.splunk.com/app/2962/

When you tested your add-on or app you can put on the Deployer  in $Splunk_Home/etc/shcluster/apps directory, so you need to manually copy the app to that directory. 

run this comand

 

 

splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

 

 

for more details there is the documentation

https://docs.splunk.com/Documentation/Splunk/8.1.3/DistSearch/PropagateSHCconfigurationchanges

let me know if you need more informations

Alessandro

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Tags (2)
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...