topic Re: Splunk apps problem in Splunk Search

Splunk apps problem

Splunk_U — Fri, 19 Apr 2013 14:12:17 GMT

I am getting an apps in the SPLUNK web ui named abc...but when ever I am going to $SPLUNK_HOME/etc/apps, that abc app is not present there. What could be the cause?

Re: Splunk apps problem

Ayn — Fri, 19 Apr 2013 14:21:49 GMT

The app's label is defined in the app's app.conf so you'd have to look at the label string there rather than the app's directory name to find which of them is "abc".

Re: Splunk apps problem

aholzer — Fri, 19 Apr 2013 14:28:38 GMT

If you go to manager > apps > "edit properties" for the app named "abc", at the top it will tell you what the "behind the scenes" name of the app is - as in where you'll find it in the etc/apps directory.

You will also be able to change what is being displayed as the app name, under the "name" field for the app.

Hope this helps.

Re: Splunk apps problem

Splunk_U — Fri, 19 Apr 2013 14:52:16 GMT

I have tried the above steps...there also the name is abc but not able to find abc folder under $SPLUNK_HOME/etc/apps

Re: Splunk apps problem

Splunk_U — Fri, 19 Apr 2013 14:53:05 GMT

as there is no app named abc at $SPLUNK_HOME/etc/apps so app.config file is also not present there

Re: Splunk apps problem

aholzer — Fri, 19 Apr 2013 15:00:49 GMT

In which case you should use Ayn's hints and run a search for files named app.conf on the server where you have your Splunk installation. Then look through the files for one that is either in a folder "abc" or contains "abc" in it.

Re: Splunk apps problem

aholzer — Fri, 19 Apr 2013 15:02:42 GMT

Also just to clarify, you are saying that in the manager > apps page, you have an app that has the value "abc" under both the name and folder name columns, correct?

Re: Splunk apps problem

Splunk_U — Fri, 19 Apr 2013 15:04:14 GMT

Yes...both the name and the folder name is abc....but there is no directory named abc under $SPLUNK_HOME/etc/apps

Re: Splunk apps problem

aholzer — Fri, 19 Apr 2013 15:12:28 GMT

Don't know if you noticed my comment before the clarification, but here it is again just in case:

"In which case you should use Ayn's hints and run a search for files named app.conf on the server where you have your Splunk installation. Then look through the files for one that is either in a folder "abc" or contains "abc" in it."

Re: Splunk apps problem

Splunk_U — Fri, 19 Apr 2013 15:19:06 GMT

I have cheked all the app.conf file present on that particular server but did not get anywhere abc. Even tried to get abc as a folder or as a word in the server but did not find it.

Re: Splunk apps problem

aholzer — Fri, 19 Apr 2013 15:37:10 GMT

Look up the objects linked to the app, and then look for the files that define those objects.

Re: Splunk apps problem

Splunk_U — Fri, 19 Apr 2013 15:47:39 GMT

I have looked up the object links for abc...nothing is prset under Manager>All configurations for the abc app

Re: Splunk apps problem

aholzer — Fri, 19 Apr 2013 15:54:03 GMT

Go to manager > apps > find the abc app, and click the "view objects" link on that line.

What is your end goal with this app? Are you trying to make it so it doesn't show up anymore? Consider disabling it, or setting it to "visible" - no.