Upgrade of Palo Alto Networks App to 6.0.0

[micmaher]

I'm using Splunk Enterprise 6.6.3.

I've used the Update link on the Apps dashboard of my master to perform the upgrade of Palo Alto Networks App to version 6.0.0 from 5.4.2

I've actually done this procedure a couple of times. After restarting the Splunk service the I see a banner displayed when I re-login saying . . . 'App "Palo Alto Networks" was installed successfully

However, back at the main page the Palo Alto Networks App still shows the Update button below it.

/etc/apps/SplunkforPaloAltoNetworks/Readme.md shows App Version 6.0.0 so the files are in place. But if I open the App from the dashboard and click About at the bottom it shows 5.4.2

The add-on Splunk_TA_paloalto is upgraded to 6.0.0 too.

The issue is resolved but I had to completely remove and reinstall the app rather than upgrade

[btorresgil · Accepted solution]

Thanks for reporting this. My guess on what happened is you had a copy of app.conf in the local directory which had the old version in it. This could cause Splunk to think the old version is installed, even after installing the new version. Unfortunately, as app developers, we don't get to control the local directory to ensure it is ready for an upgrade, we can only control the default directory. Thanks again for reporting this so others can know what to do if they see a similar issue.

For anyone hitting this issue, try checking if you have a file in the app/add-on directory called local/app.conf and delete it.