topic Re: How to disable update checking in Splunk server / where to locate app.conf? in Knowledge Management

How to disable update checking in Splunk server / where to locate app.conf?

jankowsr — Thu, 29 May 2014 13:54:26 GMT

Splunk 6.0.2 (build 196940), Ubuntu 12.04

I have seen
http://answers.splunk.com/answers/28616/how-can-automatic-update-checking-be-disabled-forsplunkbase-apps

[...]

In the desired app's
$SPLUNK_HOME/etc/apps/<appname>local/app.conf
(if this does not
exist, create one) and include:
[package]
check_for_updates = 0

[...]

but I can't find out the <appname>.
I tried to create /opt/splunk/etc/apps/local/app.conf, issued /etc/init.d/splunk restart but no success (splunk is checking for updates)
I referred to
http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Appconf
and http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Configurationfiledirectories, especially the $SPLUNK_HOME/etc/apps/<app_name>/[local|default] paragraph
and still have no clue where my app.conf should be located. At the moment I have app.conf files in the following directories:

/opt/splunk/etc/apps/user-prefs/default/app.conf
/opt/splunk/etc/apps/launcher/default/app.conf
/opt/splunk/etc/apps/splunk_datapreview/default/app.conf
/opt/splunk/etc/apps/gettingstarted/default/app.conf
/opt/splunk/etc/apps/legacy/default/app.conf
/opt/splunk/etc/apps/search/default/app.conf
/opt/splunk/etc/apps/SplunkForwarder/default/app.conf
/opt/splunk/etc/apps/SplunkLightForwarder/default/app.conf
/opt/splunk/etc/apps/sample_app/default/app.conf
/opt/splunk/etc/apps/framework/server/apps/homefx/splunkd/default/app.conf
/opt/splunk/etc/apps/framework/server/apps/quickstartfx/splunkd/default/app.conf
/opt/splunk/etc/apps/framework/server/splunkdj/app_templates/basic/splunkd/default/app.conf
/opt/splunk/etc/apps/framework/server/splunkdj/app_templates/splunkweb/default/app.conf

Re: How to disable update checking in Splunk server / where to locate app.conf?

somesoni2 — Thu, 29 May 2014 14:27:59 GMT

You want to disable the Splunk update check that happens at login page?

Re: How to disable update checking in Splunk server / where to locate app.conf?

jankowsr — Thu, 29 May 2014 14:48:48 GMT

Yes, this is correct.

Re: How to disable update checking in Splunk server / where to locate app.conf?

dmaislin_splunk — Thu, 29 May 2014 15:19:03 GMT

http://answers.splunk.com/answers/2116/how-can-i-disable-the-login-notification-message-that-a-new-splunk-version-is-available

web.conf contains the setting from which you can disable Splunk
automatic checking for new versions:

By default the setting:

updateCheckerBaseURL = http://quickdraw.splunk.com/js/
To disable automatic checking, add to your $SPLUNK_HOME/etc/system/local/web.conf in

[settings]

updateCheckerBaseURL = 0
Note: Disabling this feature will apply to all Splunk non-admin and admin users.

For further information refer to:

http://www.splunk.com/base/Documentation/4.0.11/Admin/Webconf

Re: How to disable update checking in Splunk server / where to locate app.conf?

jankowsr — Thu, 29 May 2014 15:32:50 GMT

I have seen updateCheckerBaseURL and updateCheckerBaseURL options but they are part of the web.conf and my question corresponds to app.conf

Re: How to disable update checking in Splunk server / where to locate app.conf?

dmaislin_splunk — Thu, 29 May 2014 15:34:50 GMT

I am confused because you said yes to the question of: You want to disable the Splunk update check that happens at login page?

Re: How to disable update checking in Splunk server / where to locate app.conf?

jankowsr — Mon, 28 Sep 2020 16:45:17 GMT

This is correct but I want to use check_for_update option from app.conf file and I don't know where app.conf should be located. Apologize if I was not clear enough in previous posts.

Re: How to disable update checking in Splunk server / where to locate app.conf?

dmaislin_splunk — Mon, 28 Sep 2020 16:45:19 GMT

So it works like this. In $SPLUNK_HOME/etc/apps/APPNAME there is a default folder for each app. Don't mess with that. In the $SPLUNK_HOME/etc/apps/APPNAME you can create a folder called local, i.e.: $SPLUNK_HOME/etc/apps/APPNAME/local with an app.conf file in there if it doesn't already exist. In any case, just add this one line:

check_for_updates = 0

Then restart Splunk.

Re: How to disable update checking in Splunk server / where to locate app.conf?

jankowsr — Mon, 28 Sep 2020 16:45:22 GMT

ok, that's what i did:

# mkdir -p /opt/splunk/etc/apps/APPNAME/local
# echo -e "[package]\ncheck_for_updates = 0\n" > /opt/splunk/etc/apps/APPNAME/local/app.conf
# cat /opt/splunk/etc/apps/APPNAME/local/app.conf
[package]
check_for_updates = 0

# /etc/init.d/splunk restart

... logged in to splunk and it is still checking for updates.

Re: How to disable update checking in Splunk server / where to locate app.conf?

dmaislin_splunk — Thu, 29 May 2014 16:21:14 GMT

Now you do understand that I meant for every single app that is under $SPLUNK_HOME/etc/apps, you have to go into each app, create a local folder, and in that local folder put or update the app.conf there.

DO NOT create an APPNAME folder. Does that make sense?

Re: How to disable update checking in Splunk server / where to locate app.conf?

jankowsr — Mon, 28 Sep 2020 16:45:25 GMT

In /opt/splunk/etc/apps I have 12 subfolders. You mean I should create in EACH of them "local" folder and in EVERY "local" folder create app.conf file (if not exists) and add "check_for_updates = 0" entry in ALL 12 app.conf files to get rid of update notification at login page?

Re: How to disable update checking in Splunk server / where to locate app.conf?

dmaislin_splunk — Thu, 29 May 2014 16:47:15 GMT

If you are trying to disable the check at the login page, follow my original advice. It is not done in the app.conf at all.

web.conf contains the setting from which you can disable Splunk
automatic checking for new versions:

By default the setting:
updateCheckerBaseURL = http://quickdraw.splunk.com/js/
To disable automatic checking, add to your $SPLUNK_HOME/etc/system/local/web.conf in

[settings]

updateCheckerBaseURL = 0
Note: Disabling this feature will apply to all Splunk non-admin and admin users.

http://www.splunk.com/base/Documentation/4.0.11/Admin/Webconf

Re: How to disable update checking in Splunk server / where to locate app.conf?

dmaislin_splunk — Mon, 28 Sep 2020 16:45:28 GMT

If you are doing this on a per app basis, then you add this to the app.conf in each local directory:

[package]
check_for_updates = 0

Re: How to disable update checking in Splunk server / where to locate app.conf?

jankowsr — Mon, 28 Sep 2020 16:45:30 GMT

If you are trying to disable the check at the login page, follow my original advice. It is not done in the app.conf at all.

Ok, that answers my question. It seems that I incorrectly assumed that this notification comes from one of the apps and it would be fine to add "check_for_updates = 0" in just one app.conf but it seems I was wrong. I probably should have read more carefully app.conf doc but maybe it would be worth to make make clear distinction between these two options and note that only updateCheckerBaseURL is responsible for notification at login page.
Thank you for your support.

Re: How to disable update checking in Splunk server / where to locate app.conf?

dhergert — Sun, 28 Jun 2015 12:11:11 GMT

Am I the only one that finds it frustrating that of the ump-teen settings that can be changed via the UI, that this is not one of them?