Update the federated search configuration

Change the provider or index configuration after initial setup.

Update the federated search configuration after initial setup to change provider or index settings.

  1. Change to the app directory and edit federated.conf or indexes.conf as needed.
    CODE 
    cd federated-search-app
  2. Repackage and upload the app.
    CODE 
    tar czf ../federated-search-app_1.0.1.tgz .
az storage blob upload \
  --account-name splunkapps95484 \
  --container-name splunk-apps \
  --name "localApps/federated-search-app_1.0.1.tgz" \
  --file ../federated-search-app_1.0.1.tgz \
  --overwrite

App Framework deploys the update within 5 minutes, the default poll interval.

Rotate the service account password

Change the federated search service account password on the REMOTE and LOCAL clusters.

Rotate the service account password regularly as a security best practice.

  1. Update the password on the REMOTE cluster.
    CODE 
    kubectl -n $NAMESPACE exec $REMOTE_POD -c splunk -- \
  /opt/splunk/bin/splunk edit user fsh_svc \
  -password 'NewSecureP@ssw0rd' \
  -auth admin:<password>
  2. Update the password in federated.conf on the LOCAL cluster, then redeploy the app with the new password.

Add a federated index

Add a new federated index after initial setup.

Add a federated index when you need to expose another REMOTE index to the LOCAL cluster.

  1. Update the permissions on the REMOTE cluster with the full allowed-index list, including every remote index the service account should keep, not just the new one.
    CODE 
    kubectl -n $NAMESPACE exec $REMOTE_POD -c splunk -- curl -sk \
  -u "admin:<password>" \
  "https://localhost:8089/services/authorization/roles/fsh_user" \
  -d "srchIndexesAllowed=_audit,demo,new_index"
  2. Add the new index to indexes.conf on the LOCAL cluster.
    CODE 
    cat >> federated-search-app/default/indexes.conf << 'EOF'

[federated:r_new_index]
federated.provider = remote_thru_nginx
federated.dataset = index:new_index
EOF
  3. Redeploy the app.