topic Re: Preserve data inputs when upgrading custom app in Splunk Dev

How to preserve all configured data inputs when upgrading a custom app using Splunk Add-on Builder?

benhooper — Fri, 25 Sep 2020 21:38:22 GMT

I've found that upgrading a custom app built with Splunk Add-on Builder is clearing all configured data inputs. Is there a way to prevent this?

Re: Preserve data inputs when upgrading custom app

rnowitzki — Wed, 26 Aug 2020 10:00:21 GMT

Hi @benhooper ,

My guess is, that the definitions / .conf files were stored in the ./default directory of the app and not ./local, so they were overwritten when the app was updated.

BR
Ralph

Re: Preserve data inputs when upgrading custom app

benhooper — Wed, 26 Aug 2020 10:10:25 GMT

Hi @rnowitzki,

Good idea but I've just checked and found that this configuration is stored in file /opt/splunk/etc/apps/<app name>/local/inputs.conf.

Thanks,

Ben.

Re: Preserve data inputs when upgrading custom app

rnowitzki — Wed, 26 Aug 2020 10:16:59 GMT

Hi @benhooper,

Hmm, ok. Is it stored in ./local within structure of the tar.gz of the app? That would be against the law 🙂

Or do you mean, the inputs.conf is still there in the filesystem, but you don't see it in the gui?

BR
Ralph

Re: Preserve data inputs when upgrading custom app

benhooper — Wed, 26 Aug 2020 10:29:08 GMT

Hi @rnowitzki,

My previous message was in regards to where the active, correct configuration is stored.

Your message led me to look inside the archive and I found that, by default, the file <appName>_<appVersion>_export.tgz/<appName>_<appVersion>_export.tgz/<appName>/local/inputs.conf exists and contains the default / generic config. Simply deleting that file from the archive solves the problem because it can't be used to overwrite the live file.

Thanks!

Re: Preserve data inputs when upgrading custom app

benhooper — Fri, 28 Aug 2020 19:17:54 GMT

Bonus points to anyone who can tell me how I can prevent these files from being exported in the first place! It's a nuisance having to manually remove them every time I export.

Re: Preserve data inputs when upgrading custom app

rnowitzki — Mon, 31 Aug 2020 08:14:19 GMT

Hi @benhooper ,

You mean to prevent that the inputs.conf of the tar.gz overwrites the inputs.conf of the App?

The problem is with the archive itself, it should not have any inputs.conf in ./local. It should deliver its inputs.conf in the ./default directory. That way it would extract the new copy, but the app would still use the one in ./local because of conf file precedence rules.

Where is the app coming from?

BR
Ralph

Re: Preserve data inputs when upgrading custom app

benhooper — Tue, 01 Sep 2020 09:08:21 GMT

Hi @rnowitzki ,

The app is being exported from the Splunk Add-on Builder.

Thanks,

Ben.

Re: Preserve data inputs when upgrading custom app

benhooper — Mon, 14 Sep 2020 11:38:22 GMT

BUMP.