Upgrading Standalone Search Head App

splkmika1 — Thu, 26 Jul 2018 05:59:19 GMT

I have a Splunk Enterprise distributed environment setup with 1 search head, 2 Clustered indexers, a Cluster master, and a Deployment Server/License Server.

I recently installed both the Cisco-networks-add-on-for-splunk-enterprise_254 and the cisco-networks-app-for-splunk-enterprise_254 on my search head. Today I upgraded the cisco networks app from 254 to 255 using the following cli command:

 ./splunk install app <app_package_filename> -update 1 -auth <username>:<password>

This appeared to upgrade the app ok and it fixed the issue that I was having with the Overview Dashboard, however have noticed that if I click on App:Cisco Networks>Inventory>Interfaces, then I get the following error:

Error in 'PivotProcessor':Error in 'PivotUtil': The dataset 'interface' has no field 'index'

I am using a custom index for my cisco syslogs. Do I need to modify the app accordingly?

Re: Upgrading Standalone Search Head App

renjith_nair — Thu, 26 Jul 2018 06:22:28 GMT

@splkmika1 , the customization including the index (if you have put in the default) might have been overwritten by the installation/upgrade of new app. Since you have already updated the app, just have a look at the configuration files especially indexes.conf to see if your customization still exists

topic Upgrading Standalone Search Head App in All Apps and Add-ons

Upgrading Standalone Search Head App

Re: Upgrading Standalone Search Head App