topic How to disable Splunk app with curl command? in Getting Data In

How to disable Splunk app with curl command?

srinivasup — Wed, 18 Jan 2017 03:21:10 GMT

Does anyone know the curl command to disable Splunk app?

Re: How to disable Splunk app with curl command?

renjith_nair — Wed, 18 Jan 2017 06:07:15 GMT

Try

curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/<your app name>/configs/conf-app/install -d state=disabled

Reference :
http://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Appconf#.5Binstall.5D
https://docs.splunk.com/Documentation/Splunk/6.5.1/RESTREF/RESTconf#configs.2Fconf-.7Bfile.7D.2F.7Bstanza.7D

Re: How to disable Splunk app with curl command?

aaraneta_splunk — Mon, 23 Jan 2017 02:23:19 GMT

@srinivasup - Were you able to test out renjith.nair's solution? Did it work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!

Re: How to disable Splunk app with curl command?

dineshraj9 — Thu, 27 Apr 2017 12:20:38 GMT

Try using the below CURL commands to enable/disable -

curl -k -u admin:password https://localhost:8089/servicesNS/nobody/-/apps/local/<your_app_name>/disable -X POST
curl -k -u admin:password https://localhost:8089/servicesNS/nobody/-/apps/local/<your_app_name>/enable -X POST

However, it will make the change only on the search head where you issue the CURL command. You may have to run the same command on all SHC peers.

Re: How to disable Splunk app with curl command?

dineshraj9 — Thu, 27 Apr 2017 12:21:58 GMT

I had tried this, but didn't work. Being a configuration it requires a restart for the state change to reflect.