KB 144 (Splunk): Guide to replicate PowerConnect Setup page configuration on a search head cluster

Category: Problem/Information/Recommendation

Priority: Normal

Platform: Splunk On-Prem / Splunk Cloud

Version: 1 from 22.02.2022

Description

In a search head cluster environment, initial PowerConnect setup page keeps coming up even though the setup was completed.

Cause

In a cluster environment, the search head nodes the users logon to keeps changing dynamically and the set-up done on one node is not replicated across all nodes. This leads to PowerConnect setup page reappearing multiple time.

Resolution

To replicate the setup page configuration across the search heads, we need to make changes in server.conf file. In the app package “BNW-app-powerconnect”, the file attachment with this KB article should be added at the following locations:

  • server.conf: Location: <Splunk Home>/etc/apps/<BNW-app-powerconnect>/local

By adding this to local, the changes would be retained in subsequent app upgrades.

Splunk Cloud Cluster environment

Users need to raise a ticket to the Splunk cloud Support Team to add the file attached with this KB article on the Splunk Cloud. After the files are added, users need to configure the setup page at least once on any of the search heads.

Steps (which would be followed by the support team):

  • Copy Files from local PC to bastion server:
    scp <file-path1> <file-path2> <file-path3> <username>@<bastion-server-url>:/home

  • Connect with Bastion server:
    ssh <username>@<bastion-server-url>

  • cd /home

  • Copy files from Bastion server to Cluster Master:
    scp <file-name> <username>@<cluster-master-url>:/home

  • Go to Cluster Master:
    ssh <username>@<cluster-master-url>

  • Change to root user:
    sudo su

  • Create new local directly to copy .conf files:
    mkdir /opt/splunk/etc/shcluster/apps/BNW-app-powerconnect/local

  • Copy files from /home to shcluster/apps directory (Note: If there is already server.conf present in local directory, then it wll be overwritten):
    cp -i server.conf /opt/splunk/etc/shcluster/apps/BNW-app-powerconnect/local

  • Push files in Search Heads (SHs):

    • cd /opt/splunk/etc/shcluster/apps/

    • chown splunk:splunk server.conf

    • sudo su splunk

    • /opt/splunk/bin/splunk apply shcluster-bundle -target <captain-url>

  • Get exit from root user:
    exit

  • cd /home

  • rm -rf server.conf

  • Now you will be at Cluster Master

  • exit (Get exit from Cluster Master)

  • Now you will be at Bastions

  • exit (Get exit from Bastions server)

Splunk On-Prem environment

  • Place the server.conf file at BNW-app-powerconnect/local on any of the search heads

  • After that run the below command for all the search heads
    Command: splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

    • URI: Search head URI

    • management_port : Search Head Management Port

    • Username: Splunk UI Username

    • Password: Splunk UI Password

File Attachment

server.conf