All Apps and Add-ons

Introspection app: why is excludeFromUpdate is not ignoring the directories?

mahajanamit
Explorer

I am trying to push a specific .conf as part of the /local directory of myApp from Deployment Server.

I have provided the excludeFromUpdate attribute to ignore a couple of directories which I do not want to be impacted in the app. But when the app is pushed, I see on the forwarders the /local directory that i pushed but removes the 2 "to be excluded" directories mentioned in my serverclass.conf.

In my serverclass.conf I have -

[serverClass:all_forwarders:app:introspect]
excludeFromUpdate = $app_root$/default, $app_root$/bin
restartSplunkd = 1

I am trying to push the "introspect" app from DS having a /local directory which contains a .conf file.
But when the app is pushed, it removes the /default and /bin directories on UF which I don't want to get impacted.

I have verified the versions of my DS ad UFs, they are above 6.2
Any ideas on what am I missing here ?

0 Karma

jkat54
SplunkTrust
SplunkTrust

Are there any other configs overriding excludeFromUpdate?

Try /opt/splunk/bin/splunk btool serverclass list --debug to see what settings are being applied.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

In your deployment-apps directory, does your introspect app have only the local sub-directory OR does it have both default and bin as well?

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @mahajanamit,

After modifying serverclass.conf, have you reloaded deployment server ?

Thanks,
Harshil

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...