Deploy Splunk Stream on a search head cluster
This topic shows you how to deploy Splunk Stream on a search head cluster (SHC). For more information see, Use the deployer to distribute apps and configuration updates in Distributed Search.
Before you deploy Splunk Stream to a search head cluster, make sure your Splunk Enterprise deployment includes:
- An existing search head cluster, including a minimum of 3 search heads, any number of search peers (indexers), and a deployer server (outside the cluster). See Deploy a search head cluster in the Distributed Search manual.
Step 1. Install Splunk Stream on the deployer
- Use Splunk Web to Install
splunk-stream_<latest_version>.tgzonto the deployer in
Splunk_TA_streamto the configuration bundle at
For information on the structure of the configuration bundle, see Where to place the configuration bundle on the deployer in Distributed Search.
Splunk_TA_stream is required on search heads, indexers, and forwarders so that props and transforms stanzas can be applied. To stop data capture on a search head, disable the
streamfwd "Wire Data" modular input.
Step 2. Deploy the configuration bundle to the cluster
splunk apply shcluster-bundle command on the deployer.
splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>
-target parameter (required) specifies the URI and management port for any member of the cluster. For example: https://10.0.1.14:8089. Though you specify a single cluster member only, the deployer pushes the URI and management port to all members.
-auth parameter specifies credentials for the deployer instance. This pushes everything contained in the
shcluster/ directory (including
Splunk_TA_stream) from the deployer to each search head cluster member.
For more information, see Deploy a configuration bundle in the Distributed Search manual.
Upgrade Splunk Stream in a search head cluster
To upgrade Splunk Stream on a search head cluster, follow the same steps that you used to deploy Splunk Stream on the search head cluster initially. See Deploy Stream on a search head cluster.
When you move the updated version of the app to the configuration bundle, you overwrite the existing version of the app.
For more information on app upgrades in a search head cluster, see Use the deployer to distribute apps and configuration updates in Distributed Search.
Deploy independent Stream forwarder
Deploy Splunk Stream on Splunk Cloud
This documentation applies to the following versions of Splunk Stream™: 7.1.2, 7.1.3, 7.2.0