topic Re: Disabling Splunk Secure Gateway in a Cluster Deployment in Installation

Disabling Splunk Secure Gateway in a Cluster Deployment

sherwin_r — Mon, 12 Aug 2024 07:19:10 GMT

I am trying to disable the Splunk Secure Gateway app in a clustered environment. However I dont see an option to disable the app in Apps -> Manage Apps. It only displays the current status of the app, which is "Active".

I also tried the same in a single node installation, where there is an option to disable the app just next to its current status in the same menu, i.e. Apps -> Manage Apps.

So, how can I disable the Splunk Secure Gateway in the clustered environment ?

Re: Disabling Splunk Secure Gateway in a Cluster Deployment

gcusello — Mon, 12 Aug 2024 07:32:35 GMT

Hi @sherwin_r ,

the only way to disable an app in a clustered environament is to modify the app.conf file in the app's local folder (if not present, copying it from default) of the deployer (app located in shcluster folder) and pushing the modified app to the cluster.

But why do you want to do this?

Ciao.

Giuseppe

Re: Disabling Splunk Secure Gateway in a Cluster Deployment

sherwin_r — Mon, 12 Aug 2024 07:36:52 GMT

Hi @gcusello ,

Thanks for the quick response.

I want to do this because my Splunk installation does not have access to the internet and Secure Gateway therefore logs a lot of errors.

Regards,

Sherwin

Re: Disabling Splunk Secure Gateway in a Cluster Deployment

gcusello — Mon, 12 Aug 2024 07:44:44 GMT

Hi @sherwin_r ,

this should occur if you try to enable some input in Secure Gateway not by itself, did you do it?

Ciao.

Giuseppe

Re: Disabling Splunk Secure Gateway in a Cluster Deployment

isoutamo — Mon, 12 Aug 2024 07:49:23 GMT

this is known issue. You cannot disable some apps via GUI. Fortunately you could try this app to disable SSG and some other https://splunkbase.splunk.com/app/7319

r. Ismo

Re: Disabling Splunk Secure Gateway in a Cluster Deployment

sherwin_r — Mon, 12 Aug 2024 07:59:47 GMT

Hi Ismo,

This solution seems to be amazing. However, I will have to try to solve this as far as possible without installing an extra app.

Best regards,

Sherwin

Re: Disabling Splunk Secure Gateway in a Cluster Deployment

isoutamo — Mon, 12 Aug 2024 15:26:33 GMT

Unfortunately I don't think that you have any other option. That was the reason why @gjanders did this app...

Re: Disabling Splunk Secure Gateway in a Cluster Deployment

gcusello — Mon, 12 Aug 2024 15:32:19 GMT

Hi @sherwin_r ,

if you cannot follow the solution from @isoutamo , the only way is my first solution, modify apps.conf on the Deployer and push the app to the Search Head Cluster.

Ciao.

Giuseppe

Re: Disabling Splunk Secure Gateway in a Cluster Deployment

gjanders — Mon, 12 Aug 2024 21:52:57 GMT

Exactly. Disabling default apps is a bit tricky.

Combine this with the 9.1.x version running a search on every instance and then an automated method like this helps on large indexer clusters, cluster managers et cetera.

The application works on most apps, I did find the splunk assist app cannot be disabled using the REST API.

Thanks @isoutamo

Re: Disabling Splunk Secure Gateway in a Cluster Deployment

sherwin_r — Tue, 13 Aug 2024 08:58:40 GMT

Thanks @gcusello @gjanders @isoutamo for your inputs. I will have to decide which solution I am going for. I will update if either worked as expected (however I expect it to take a couple of days).

Regards,

Sherwin

Re: Disabling Splunk Secure Gateway in a Cluster Deployment

gcusello — Tue, 13 Aug 2024 09:01:55 GMT

Hi @sherwin_r ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: Disabling Splunk Secure Gateway in a Cluster Deployment

computermathguy — Wed, 16 Apr 2025 12:44:11 GMT

I assume app should be

[install]
state = disable

or disabled ?