Configuration distribution

As we have covered, in some depth, configurations in Splunk are simply directories of plain text files. Distribution essentially consists of copying these configurations to the appropriate machines and restarting the instances. You can either use your own system for distribution, such as puppet or simply a set of scripts, or use the deployment server included with Splunk.

Using your own deployment system

The advantage of using your own system is that you already know how to use it. Assuming that you have normalized your apps as described in the section Using apps to organize configuration, deploying apps to a forwarder or indexer consists of the following steps:

1. Set aside existing apps at $SPLUNK_HOME/etc/apps/.

2. Copy apps into $SPLUNK_HOME/etc/apps/.

3. Restart Splunk forwarder. Note that this needs to be done as the user that is running Splunk, either by calling the service script or calling su. On Windows, restart the splunkd service.

Assuming you already have a system...