topic How to Prevent /lib folder of an app to be overridden? in Splunk Enterprise

How to Prevent /lib folder of an app to be overridden?

GaetanVP — Mon, 24 Jul 2023 17:42:34 GMT

Hello Splunkers,

I would like to know if it's possible to prevent /lib path of a Splunk app to be overridden after an upgrade of this app.

For instance, I edited the cacert.pem file in the following path

/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/lib/certifi/cacert.pem

And after the upgrade of the Splunk_TA_microsoft-cloudservices app, the cacert.pem has been replaced during the upgrade.

Would it be possible to avoid that ?

Regards,

GaetanVP

Re: Prevent /lib folder of an app to be overridden

richgalloway — Mon, 24 Jul 2023 15:18:39 GMT

If you move the cert to the local directory then it won't be overwritten during an upgrade.

/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/local/cacert.pem

Re: How to Prevent /lib folder of an app to be overridden?

SplunkExplorer — Tue, 25 Jul 2023 07:39:31 GMT

I confirm @richgalloway words. Local folders are designed to enable custom change without risks of update overrides; this help also to avoid custom/manual change in default folders, that shouldn't be changed as it's not a Splunk best pratice.