All Apps and Add-ons

Upgrading Standalone Search Head App

splkmika1
Explorer

I have a Splunk Enterprise distributed environment setup with 1 search head, 2 Clustered indexers, a Cluster master, and a Deployment Server/License Server.

I recently installed both the Cisco-networks-add-on-for-splunk-enterprise_254 and the cisco-networks-app-for-splunk-enterprise_254 on my search head. Today I upgraded the cisco networks app from 254 to 255 using the following cli command:

 ./splunk install app <app_package_filename> -update 1 -auth <username>:<password>

This appeared to upgrade the app ok and it fixed the issue that I was having with the Overview Dashboard, however have noticed that if I click on App:Cisco Networks>Inventory>Interfaces, then I get the following error:

Error in 'PivotProcessor':Error in 'PivotUtil': The dataset 'interface' has no field 'index'

I am using a custom index for my cisco syslogs. Do I need to modify the app accordingly?

renjith_nair
SplunkTrust
SplunkTrust

@splkmika1 , the customization including the index (if you have put in the default) might have been overwritten by the installation/upgrade of new app. Since you have already updated the app, just have a look at the configuration files especially indexes.conf to see if your customization still exists

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...