topic Re: Avoid app update when deployer push bundle in Splunk Enterprise

Avoid app update when deployer push bundle

SplunkExplorer — Wed, 02 Apr 2025 12:54:28 GMT

Hi Splunkers, today I have the following issue: on our SHC, there is a small app subset that is managed, and so modified, from their user directly on SHs.

What does it means for us? Of course, that we need to perform version updates from SH to Deployer before perform a new app bundle push. Otherwise, older version on Deployer will override the updated one on SH.
My wondering is: is there any way, on Splunk version 9.2.1, to avoid this app update when Deployer is used?
The final purpose, just to make an example, is: ehy, if deployer has 100 apps in $SPLUNK_HOME$/etc/shcluster/apps, we want that on a bundle push, 95 of them must be updated, if SH version is NOT equal to Deployer one; remaining 5, should not be updated by Deployer.

Re: Avoid app update when deployer push bundle

livehybrid — Wed, 02 Apr 2025 13:56:31 GMT

Hi @SplunkExplorer

When changes to apps are made on your SHC - the changes are applied to the ./local folder within the app on the SHC, whereas the content pushed from your deployer generally lands in the ./default directory.

This means that if users have modified any of the knowledge objects since it was pushed from the deployer, they wont be overwritten when a subsequent deployment is done.

Check out the docs for more info "Because of how configuration file precedence works, changes that users make to apps at runtime get maintained in the apps through subsequent upgrades."

🌟 Did this answer help you? If so, please consider:

Adding kudos to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

Re: Avoid app update when deployer push bundle

isoutamo — Wed, 02 Apr 2025 19:33:41 GMT

Have you try different Push modes? See https://docs.splunk.com/Documentation/Splunk/9.2.1/DistSearch/PropagateSHCconfigurationchanges#Choose_a_deployer_push_mode

You could set this separately for each app in it's app.conf file or globally in .../etc/system/local/app.conf