Advanced Deployments - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 360

homePath = volume:large_home/app
coldPath = volume:large_cold/app
thawedPath = /big_slow/thawed/app

[main]
homePath = volume:large_home/main
coldPath = volume:large_cold/main
thawedPath = /big_slow/thawed/main

local/inputs.conf
[splunktcp://9997]

local/server.conf
[license]
master_uri = https://spl-license.foo.com:8089

This is a minimal set of apps, but it should provide a decent overview of what is
involved in configuring a distributed configuration. Next, we will illustrate where
these apps should go.

Configuration distribution
As we have covered, in some depth, configurations in Splunk are simply directories
of plain text files. Distribution essentially consists of copying these configurations
to the appropriate machines and restarting the instances. You can either use your
own system for distribution, such as puppet or simply a set of scripts, or use the
deployment server included with Splunk.

Using your own deployment system
The advantage of using your own system is that you already know how to use it.
Assuming that you have normalized your apps as described in the section Using
apps to organize configuration, , deploying apps to a forwarder or indexer consists
of the following steps:

1. Set aside existing apps at $SPLUNK_HOME/etc/apps/ .

2. Copy apps into $SPLUNK_HOME/etc/apps/ .

3. Restart Splunk forwarder. Note that this needs to be done as the user that

is running Splunk, either by calling the service script or calling su . On
Windows, restart the splunkd service.

Assuming you already have a system for managing configurations, that's it.