KB 144 (Splunk): Guide to replicate PowerConnect Setup page configuration on a search head cluster

Description

In a search head cluster environment, initial PowerConnect setup page keeps coming up even though the setup was completed.

Cause

The app.conf and custom configuration files do not get replicated in a cluster environment after installation or upgrade, leading to replication issues.

Resolution

NOTE: As of 01 July 2022, this issue can be resolved by restarting the search head. This will work on PowerConnect App for Splunk v6.9.1 and above, both on-prem and cloud. The old documentation can be found below.

* * *

To replicate the setup page configuration across the search heads, we need to make changes in server.conf file. In the app package “BNW-app-powerconnect”, the file attachment with this KB article should be added at the following locations:

• server.conf: Location: <Splunk Home>/etc/apps/<BNW-app-powerconnect>/local

By adding this to local, the changes would be retained in subsequent app upgrades.

Splunk Cloud Cluster environment

Users need to raise a ticket to the Splunk cloud Support Team to add the file attached with this KB article on the Splunk Cloud. After the files are added, users need to configure the setup page at least once on any of the search heads.

Steps (which would be followed by the support team):

• Copy Files from local PC to bastion server:
  scp <file-path1> <file-path2> <file-path3> <username>@<bastion-server-url>:/home

• Connect with Bastion server:
  ssh <username>@<bastion-server-url>

• cd /home

• Copy files from Bastion server to Cluster Master:
  scp <file-name> <username>@<cluster-master-url>:/home

• Go to Cluster Master:
  ssh <username>@<cluster-master-url>

• Change to root user:
  sudo su

• Create new local directly to copy .conf files:
  mkdir /opt/splunk/etc/shcluster/apps/BNW-app-powerconnect/local

• Copy files from /home to shcluster/apps directory (Note: If there is already server.conf present in local directory, then it wll be overwritten):
  cp -i server.conf /opt/splunk/etc/shcluster/apps/BNW-app-powerconnect/local

• Push files in Search Heads (SHs):

  • cd /opt/splunk/etc/shcluster/apps/

  • chown splunk:splunk server.conf

  • sudo su splunk

  • /opt/splunk/bin/splunk apply shcluster-bundle -target <captain-url>

• Get exit from root user:
  exit

• cd /home

• rm -rf server.conf

• Now you will be at Cluster Master

• exit (Get exit from Cluster Master)

• Now you will be at Bastions

• exit (Get exit from Bastions server)

Splunk On-Prem environment

• Place the server.conf file at BNW-app-powerconnect/local on any of the search heads

• After that run the below command for all the search heads
  Command: splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

  • URI: Search head URI

  • management_port : Search Head Management Port

  • Username: Splunk UI Username

  • Password: Splunk UI Password

File Attachment

Open