Deploy Splunk App for Stream on a search head cluster

This topic shows you how to deploy Splunk App for Stream on a search head cluster. When deploying Splunk App for Stream to a search head cluster in a production environment, note the following:

Prerequisites

• Splunk app for Stream 6.5.0 or later
• Splunk Enterprise 6.3.1 or later
• Existing search head cluster with deployer (outside cluster) and a minimum of three search head cluster members.
• KV Store must be enabled on all cluster members (enabled by default on Splunk Enterprise version 6.3.1 and later).

For more information, see Search head cluster requirements in the Distributed Search manual.

Install Splunk App for Stream on the deployer

1. Use Splunk Web to Install splunk_app_stream-6.5.x.tgz onto the deployer in $SPLUNK_HOME/etc/apps.

2. Move splunk_app_stream and Splunk_TA_stream to shcluster/apps.

Note: Splunk_TA_stream is required on search heads, indexers, and heavy forwarders so that props and transforms stanzas can be applied. To stop data capture on a search head, disable the streamfwd "Wire Data" modular input.

Deploy the configuration bundle to the cluster

Run the splunk apply shcluster-bundle command on the deployer.

splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

The -target parameter (required) specifies the URI and management port for any member of the cluster. For example: https://10.0.1.14:8089. Though you specify a single cluster member only, the deployer pushes the URI and management port to all members.

The -auth parameter specifies credentials for the deployer instance. This pushes everything contained in the shcluster/ directory (including splunk_app_stream and Splunk_TA_stream) from the deployer to each search head cluster member.

For more information, see Deploy a configuration bundle in the Distributed Search manual.