All Apps and Add-ons

Best way to update a custom app?

twinspop
Influencer

I've created a very simple app that contains only a transforms file and props file. I want to update the files with some new values. If I re-package the tgz and try to upload, Splunk tells me the app already exists. The link to "You can replace an existing app via the Splunk CLI. Learn more" doesn't help. It provides help on disabling or uninstalling an app via the CLI. No mention of replacing.

I don't have a deployment server yet.

I'm trying to avoid a Splunk restart. Is that possible?

Tags (2)

Drainy
Champion

Just another turn on this. If you use version.. 4.3 upwards I think (perhaps 4.3.1) there is actually now a tick box to select that the upload is an upgrade and it will copy the old default configs to a backup directory and install the latest version.
A restart will only be required if you are doing any endpoint magic or register brand new configs.

ChrisG
Splunk Employee
Splunk Employee

The documentation topic Manage app and add-on objects has been updated with information about how to update an existing app using the CLI, and the "Learn more" help link maps to that topic.

jbsplunk
Splunk Employee
Splunk Employee

Generally speaking, if you are replacing props and transforms, a restart is going to be required. The exception to this, if I understand correctly, would be search time field extractions. Under the current configuration, I do not think that avoiding a restart is possible.

http://www.splunk.com/base/Documentation/5.0/admin/Propsconf

To use one or more of these configurations, copy the configuration block into
props.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.

twinspop
Influencer

So through normal command line methods, replace the corresponding files and issue a restart. It seems odd that I can add transforms.conf to a Splunk server via an app and not have to restart, but changing transforms.conf for that same app requires a restart. Anyway, thanks for your input.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...