splunk / splunk-add-on-microsoft-azure

Splunk Add-on for Microsoft Azure
Apache License 2.0
11 stars 7 forks source link

Missing server.conf/[shclustering] stanza for Search Head Cluster replication #81

Open abedegno opened 2 months ago

abedegno commented 2 months ago

When deploying this add-on to a Search Head Cluster (either on-premise or Splunk Cloud) customer config is not replicated to other nodes in the Search Head Cluster.

If there’s a cluster restart, input execution may move to a new node missing the account configuration and stop working. To fix this a server.conf needs adding to the default directory with the following configuration:

[shclustering]
conf_replication_include.splunk_ta_aad_settings = true
conf_replication_include.splunk_ta_aad_account = true