Splunk Enterprise

How to Deploy ui-pref.conf in Search Head Cluster using Deployer?


We have need to set ui preference with default time range picker globally across of the searches run in Splunk. We need to deploy these configuration across all three search Head Cluster Member in SHCM (search Head Cluster Memeber Pool)

0 Karma

Splunk Employee
Splunk Employee

Deployed application named "search_head_pushed_config" from deployer to Search head Cluster members.
The app has the following configuration was specified in ui-prefs.conf :
dispatch.earliest_time = -15m
dispatch.latest_time = now

The config was pushed to the search cluster.

Note : Also for the App, “search_head_pushed_config” enabled settings for exporting globally by defining folloing, If not, its ui-prefs.conf will not be visible to other apps, which will prevent the timepicker customizations from applying in other app contexts.


This behavior is similar to non -cluster Search head.


So when you say to put these setting in $SPLUNK_HOME/etc/shcluster/apps/search_head_pushed_config/metadata Im guessing you mean the default.meta file?

What would happen over the course of time if I start adding new knowledge objects to the search_head_pushed_config app from the Splunk UI which creates a local.meta file, and then one day i push a update to this app from the deployer, will it delete my local.meta file since my deployer metadata folder only contains the default.meta? Im just now setting up my Search Head Cluster and still reading the docs but I haven't yet read anything that talks about how the metadata folder is handled if its managed by the deployer. The topics that are stressed that i read so far is what happens with the default and local directories.


0 Karma


Local search head ui modified local.meta is immune to deployer based changes.

Deployer merges all "local" based configurations into defaults. This includes local.meta which will be merged with default.meta.

It's best to try and have just the one meta file regardless so it is perfectly clear what the detault.meta will be when it is deployed to members.

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...