Configuration distribution

As we have covered, in some depth, configurations in Splunk are simply directories of plain text files. Distribution essentially consists of copying these configurations to the appropriate machines and restarting the instances. You can either use your own system for distribution, such as puppet or simply a set of scripts, or use the deployment server included with Splunk.

Using your own deployment system

The advantage of using your own system is that you already know how to use it. Assuming that you have normalized your apps as described in the section Using apps to organize configuration, deploying apps to a forwarder or indexer consists of the following steps:

  1. Set aside existing apps at $SPLUNK_HOME/etc/apps/.
  2. Copy apps ...

Get Implementing Splunk now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.