topic Re: Difference between different options for app update in Splunk Enterprise

Difference between different options for app update

dschwarz — Thu, 05 Sep 2024 10:02:06 GMT

Hello Splunkees,

what are the differences between the different options for app updates? I know 3 diffentent ways to update an app:

1) Via webinterface: Apps -> Manage Apps -> Install app from file -> Check 'Upgrade app. Checking this will overwrite the app if it already exists.'

2) Via CLI:

./splunk install app <app_package_filename> -update 1 -auth <username>:<password>

3) Extract the content of the app.tgz to $SPLUNK_HOME/etc/apps/ (if app already exists, override files) and after that restart splunk service.

Background of my question: I want to implement an automated app update process with ansible for our environment and I want to use the smartest method. Currently, we're using Splunk 9.1.5.

Thank you!

dschwarz

Re: Difference between different options for app update

richgalloway — Fri, 06 Sep 2024 15:37:16 GMT

The biggest difference is #3 requires a restart of Splunk before the app can be used. For the other methods, a restart may be needed (depending on what is changed), but may not be required.

Re: Difference between different options for app update

PickleRick — Fri, 06 Sep 2024 20:12:40 GMT

Adding to what @richgalloway already said - remember than some options might simply be not available in specific situations. Many Splunk components will actually run without web interface enabled so in those cases you will obviously not be able to use it for upgrade. If your environment grows and you step into the clustering grounds the only way of installing apps (including upgrading) will be using clustering mechanisms (either pushing from deployer or cluster manager). Even with small-scale installation you can use deployment server to serve apps to your Splunk components. And that's actually a typical Splunk way of automating app install/upgrade.