All Apps and Add-ons

Best way to update a custom app?

twinspop
Influencer

I've created a very simple app that contains only a transforms file and props file. I want to update the files with some new values. If I re-package the tgz and try to upload, Splunk tells me the app already exists. The link to "You can replace an existing app via the Splunk CLI. Learn more" doesn't help. It provides help on disabling or uninstalling an app via the CLI. No mention of replacing.

I don't have a deployment server yet.

I'm trying to avoid a Splunk restart. Is that possible?

Tags (2)

Drainy
Champion

Just another turn on this. If you use version.. 4.3 upwards I think (perhaps 4.3.1) there is actually now a tick box to select that the upload is an upgrade and it will copy the old default configs to a backup directory and install the latest version.
A restart will only be required if you are doing any endpoint magic or register brand new configs.

ChrisG
Splunk Employee
Splunk Employee

The documentation topic Manage app and add-on objects has been updated with information about how to update an existing app using the CLI, and the "Learn more" help link maps to that topic.

jbsplunk
Splunk Employee
Splunk Employee

Generally speaking, if you are replacing props and transforms, a restart is going to be required. The exception to this, if I understand correctly, would be search time field extractions. Under the current configuration, I do not think that avoiding a restart is possible.

http://www.splunk.com/base/Documentation/5.0/admin/Propsconf

To use one or more of these configurations, copy the configuration block into
props.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.

twinspop
Influencer

So through normal command line methods, replace the corresponding files and issue a restart. It seems odd that I can add transforms.conf to a Splunk server via an app and not have to restart, but changing transforms.conf for that same app requires a restart. Anyway, thanks for your input.

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...