topic Re: Why is Splunk marking a custom TA as deprecated in Getting Data In

Why is Splunk marking a custom TA as deprecated

DMohn — Tue, 05 Jan 2016 09:54:35 GMT

Hi Splunkers

We have built a custom technical add-on for our BlueCoat Appliances. Now Splunk is marking this TA as deprecated (Message: "Deprecated app TA-bluecoat is installed in the enabled state. Please uninstall this app using methods appropriate for your installation")

How can it be that Splunk marks a custom add-on as deprecated?

The app.conf setting check_for_updates is set to false - so there should be no check here.

Can we solve this somehow, as the message is quite nagging, and we are needing the TA?

Thanks for your advice.

Re: Why is Splunk marking a custom TA as deprecated

jkat54 — Tue, 05 Jan 2016 12:41:20 GMT

I would assume it's been deprecated as per the Advanced XML deprecation (release 6.3+). Unfortunately I can only comment as I dont know how to disable the message as you desire.

Re: Why is Splunk marking a custom TA as deprecated

mreynov_splunk — Tue, 05 Jan 2016 17:52:14 GMT

Not sure why the message, but perhaps you can use this TA instead: https://splunkbase.splunk.com/app/2758/

Re: Why is Splunk marking a custom TA as deprecated

DMohn — Tue, 05 Jan 2016 18:30:25 GMT

I can give the answer myself here - after some thorough investigation...

The reason was our installation of the Splunk Enterprise Security Suite. During installation the TA was marked as deprecated, as it should have been replaced by a new one.

We have removed the app out of the ESS list of deprecated apps, and everything works fine!

Re: Why is Splunk marking a custom TA as deprecated

andrew_bostic1 — Thu, 04 Feb 2016 14:11:53 GMT

Where do you find the ESS list of deprecated apps?

Re: Why is Splunk marking a custom TA as deprecated

DMohn — Thu, 04 Feb 2016 17:43:31 GMT

I found this in the ESS installation log under $SPLUNK_HOME$/var/log/splunk

Re: Why is Splunk marking a custom TA as deprecated

andrew_bostic1 — Fri, 05 Feb 2016 20:30:56 GMT

I guess a better question is how do you fix this? what needs to be updated to stop this error message?

Re: Why is Splunk marking a custom TA as deprecated

kmanson — Wed, 04 May 2016 11:50:47 GMT

During installation the TA was marked as deprecated, as it should have been replaced by a new one. In my case I am specifically using an app that has the same name as a depreciated app.

To turn off the nagging alert I removed the app from this file.
/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/install/deprecated_apps.txt