All Apps and Add-ons

How to update apps correctly via the command line?

HeinzWaescher
Motivator

Hi all,

I was wondering how to update Splunk apps correctly while keeping necessary edited configs and own files.
For single instances the documentation says:

./splunk install app -update 1 -auth username:password

  1. So this will update an app in ./etc/apps only with new defaults? Will it keep my changes? What does -update 1 do in this command?
  2. How to proceed if I want to update an App that is deployed by a Deployment Server or Cluster Master (so stored in deployment-pps or master-apps)

Thanks in advance

1 Solution

nickhills
Ultra Champion

Hi @HeinzWaescher

1- -update 1 means perform an install, but 'force' it (like the checkbox in the GUI)
Its basically saying, 'yes, this is already installed, but I want to update it with the provided package'

The format is actually /splunk install app <path to app.package> -update 1 -auth username:password

If you have modifications in your ./local folder these 'should' be preserved.
I say 'should', because an app from Splunkbase/vendor should not contain a /local folder (or it should be empty) - if it did contain files in /local these would also be replaced.

My approach is always download the package, unzip it and check first what it contains, then you know what it will/will not replace.

2- To update apps on a DS, or CM you should copy the app folder (once you have confirmed it is working as you expect) from your test server into the relevent path on the DS/CM

If my comment helps, please give it a thumbs up!

View solution in original post

nickhills
Ultra Champion

Hi @HeinzWaescher

1- -update 1 means perform an install, but 'force' it (like the checkbox in the GUI)
Its basically saying, 'yes, this is already installed, but I want to update it with the provided package'

The format is actually /splunk install app <path to app.package> -update 1 -auth username:password

If you have modifications in your ./local folder these 'should' be preserved.
I say 'should', because an app from Splunkbase/vendor should not contain a /local folder (or it should be empty) - if it did contain files in /local these would also be replaced.

My approach is always download the package, unzip it and check first what it contains, then you know what it will/will not replace.

2- To update apps on a DS, or CM you should copy the app folder (once you have confirmed it is working as you expect) from your test server into the relevent path on the DS/CM

If my comment helps, please give it a thumbs up!

rev1ver
Explorer

2- To update apps on a DS, or CM you should copy the app folder (once you have confirmed it is working as you expect) from your test server into the relevent path on the DS/CM

Should I remove the old app folder before copying over the updated app folder (on CM in manager-apps)? Or is it better to copy the updated app folder on top of the old one, overwriting duplicate files?

Is it same for Search Head Deployer?

0 Karma

HeinzWaescher
Motivator

Thanks a lot!

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...