topic Re: How I can install the same app/add-on multiple times? in Installation

How I can install the same app/add-on multiple times?

norbertt911 — Thu, 16 Jul 2020 07:57:58 GMT

Hello,

I have 2 application servers, running the same application. In Splunk, I would like to handle the logs separately. To do this I collect the data separate indexes. Splunk has a nice app for this application with a lot of dashboards and reports. I have two operators, but they have access just for one of the indexes. What I should do, if I would like that they can use the Splunk-app, but just for that index, where they have access?

If I set the app's search macro to index A, Index B is out. Adding a new search macro for index B means I need to add that all the existing searches-dashboards-reports.

How I can install the app 2 times with two different settings, pointing the different indexes?

Re: How I can install the same app/add-on multiple times?

gcusello — Thu, 16 Jul 2020 08:13:53 GMT

Hi @norbertt911,

you could create two roles, one for each operator.

Then enable the app (and all the knowledge objects) for both the roles and one index for each role.

In this way, both the operators con see the app, but only with the own index.

Obviously, you have to modify your app addressing both the indexes, the best way to do this is using eventtypes (e.g. index=indexA OR index=indexB).

in this way you have only one app and you can manage the differences at role level.

Ciao.

Giuseppe

Re: How I can install the same app/add-on multiple times?

norbertt911 — Thu, 16 Jul 2020 08:27:05 GMT

Thank you,

... in this case for me, who had access both indexes will see a "mixture" of all logs in the app, right? (that not be good at all...)

Could install the same app if I modify the app's folder's name and the app.conf in the tgz file before? Do I need to change anything else?

Re: How I can install the same app/add-on multiple times?

gcusello — Thu, 16 Jul 2020 08:40:45 GMT

Hi @norbertt911,

if you want to avoid mixture, you could add an input option in the dashboards (I did it for a customer!).

About the app, you'll have only one app, you intevene on the Splunk environment (roles).

Ciao.

Giuseppe

Re: How I can install the same app/add-on multiple times?

norbertt911 — Thu, 16 Jul 2020 08:46:00 GMT

Thanks,

Looks like there is no easy way:)

Actually I try my theory and rename the app before install. It is working except for the update...

Re: How I can install the same app/add-on multiple times?

gcusello — Thu, 16 Jul 2020 08:48:35 GMT

hi @norbertt911,

in other words, you have two apps to maintain!

you could use the Deployment Server to deploy both the apps.

Anyway, I hint to modify you app as I said: it's longer but more clear!

Ciao.

Giuseppe