Refine your search:

1
1

Is it possible to push out updates to the system/local directory using the deployment server? I tried and ended up deleting the entire system directory on the client machine. Below are the configs I used.

deployment client

[deployment-client]
clientName = indexer01
serverEndpointPolicy = rejectAlways
targetRepositoryLocation = /opt/splunk/etc/

[target-broker:deploymentServer]
targetUri=192.168.32.80:8089

deployment server

path to deployment-app

/opt/splunk/etc/deployment-apps/system/local

asked 18 Jan '11, 21:56

carmackd's gravatar image

carmackd
5384523
accept rate: 23%


One Answer:

You may be able to, but for reasons you've discovered I would advise against it. You can always create an app to push out various configurations. The app can be as minimal as a few conf files in a dir, ex: ./myapp/default/*.conf

But also from above, your targetRepositoryLocation is /opt/splunk/ect/ not /opt/splunk/etc/system/local

link

answered 19 Jan '11, 00:00

kevintelford's gravatar image

kevintelford
2601216
accept rate: 30%

I have the same question, but your solution (using an app) does not solve it.

My problem is that I'm using a volumes configuration for all my indexes, using an app pushed to all my indexers. (The app is called "myindexers".)

However, the local indexes (e.g. _audit, _internal, etc.) are residing on the same disk as my custom indexes:

$ mount
/dev/mapper/db_dg-opt on /opt/splunk/var/lib/splunk type ext3 (rw)

Since the internal indexes don't use the volumes config, the disk will fill. I've been advised by people on the IRC channel to fix this by putting some overrides in system/local that force the internal indexes to use the volumes config instead of $SPLUNK_DB. That seems workable, but I'd rather do it with the deployment server if possible, rather than hand maintaining that file on my five different indexers.

So, in that situation, is the recommendation still to manually maintain system/local/indexes.conf?

Also, since this might be of benefit (truncated to just relevant parts): $ /opt/splunk/bin/splunk cmd btool indexes list

[_internal]
coldPath = $SPLUNK_DB/_internaldb/colddb
homePath = $SPLUNK_DB/_internaldb/db
thawedPath = $SPLUNK_DB/_internaldb/thaweddb

[dev]
coldPath = volume:remote/dev/colddb
homePath = volume:local/dev/db
thawedPath = /opt/splunk/var/lib/splunk/dev/thaweddb

[volume:local]
maxVolumeDataSizeMB = 745942
path = /opt/splunk/var/lib/splunk

[volume:remote]
maxVolumeDataSizeMB = 3774873
path = /splunk_cold
(15 Nov '12, 10:26) supersleepwa...
1

It's not necessary to put volume configs for the default indexes in system/local. The local subdir of any old app (read: deployment server) will do. Conf files in the local subdir of an app override any conf files in a default directory (including system/default), and system/local rules them all. But since system/local can't (easily) be managed by the deployment server, this is why we typically install apps with their config settings in local.

TL;DR

I've used a DS app (with indexes.conf in local) to override the location of default indexes.

(16 Nov '12, 12:39) sowings

Awesome! I didn't realize that the default indexes could be overridden by a normal app. That should solve it for me. Thanks!

(19 Nov '12, 06:30) supersleepwa...
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×171

Asked: 18 Jan '11, 21:56

Seen: 1,591 times

Last updated: 19 Nov '12, 06:30

Copyright © 2005-2012 Splunk Inc. All rights reserved.