How to update apps correctly via the command line?

[HeinzWaescher]

Hi all,

I was wondering how to update Splunk apps correctly while keeping necessary edited configs and own files.
For single instances the documentation says:

./splunk install app -update 1 -auth username:password

1. So this will update an app in ./etc/apps only with new defaults? Will it keep my changes? What does -update 1 do in this command?
2. How to proceed if I want to update an App that is deployed by a Deployment Server or Cluster Master (so stored in deployment-pps or master-apps)

Thanks in advance

[nickhills · Accepted solution]

Hi @HeinzWaescher

1- -update 1 means perform an install, but 'force' it (like the checkbox in the GUI)
Its basically saying, 'yes, this is already installed, but I want to update it with the provided package'

The format is actually /splunk install app <path to app.package> -update 1 -auth username:password

If you have modifications in your ./local folder these 'should' be preserved.
I say 'should', because an app from Splunkbase/vendor should not contain a /local folder (or it should be empty) - if it did contain files in /local these would also be replaced.

My approach is always download the package, unzip it and check first what it contains, then you know what it will/will not replace.

2- To update apps on a DS, or CM you should copy the app folder (once you have confirmed it is working as you expect) from your test server into the relevent path on the DS/CM

[rev1ver]

---

2- To update apps on a DS, or CM you should copy the app folder (once you have confirmed it is working as you expect) from your test server into the relevent path on the DS/CM

---

Should I remove the old app folder before copying over the updated app folder (on CM in manager-apps)? Or is it better to copy the updated app folder on top of the old one, overwriting duplicate files?

Is it same for Search Head Deployer?

[HeinzWaescher]

Thanks a lot!