Remove Local Configuration and Restore Default

[sethmarek]

Hello,

Is there currently an intuitive capability to remove local configurations on an app so that the default configurations can be used again?

Splunk customers that I work with often create custom versions of dashboards or other configurations and sometimes may need to reset their custom configuration (the "local" copy) after an app update to use the default again. In Enterprise, you can simply delete the local copy and refresh Splunk. On Splunk Cloud, there is no way to do this that I can tell, and regardless of whether you are using Enterprise or Cloud, I have yet to learn of an intuitive way for customer Splunk Admins to revert configurations short of removing the app entirely and reinstalling it—a very imprecise solution.

Do we have some way to do this that I am not yet aware of?

[livehybrid]

Hi @sethmarek 

I agree that this is something that should be much easier but certainly isnt. Ive had a few cloud customers with this exact issue! Uninstalling and re-installing is a bit of a sledgehammer to crack a nut but unfortunately is the only way that seems to be possible, and doing so removes all local lookup/KV/local KO changes not just a single one you might be interested. If the local KO is not in the default then obviously we can delete it but not if its part of the default when the app was uploaded.

Its worth checking out the following Splunk Ideas and voting them up!

https://ideas.splunk.com/ideas/EID-I-1605

https://ideas.splunk.com/ideas/APPSID-I-520

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[sethmarek]

Thank you for sending those; I gave them my vote. It is a shame that these suggestions are nearly four years old with no visible progress. I hope they can implement something soon.

[livehybrid]

I agree! Its worth following up with your Splunk account manager to see if they can also apply pressure - together we might get there! 🤞

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing