All Apps and Add-ons

Best way to update a custom app?

twinspop
Influencer

I've created a very simple app that contains only a transforms file and props file. I want to update the files with some new values. If I re-package the tgz and try to upload, Splunk tells me the app already exists. The link to "You can replace an existing app via the Splunk CLI. Learn more" doesn't help. It provides help on disabling or uninstalling an app via the CLI. No mention of replacing.

I don't have a deployment server yet.

I'm trying to avoid a Splunk restart. Is that possible?

Tags (2)

Drainy
Champion

Just another turn on this. If you use version.. 4.3 upwards I think (perhaps 4.3.1) there is actually now a tick box to select that the upload is an upgrade and it will copy the old default configs to a backup directory and install the latest version.
A restart will only be required if you are doing any endpoint magic or register brand new configs.

ChrisG
Splunk Employee
Splunk Employee

The documentation topic Manage app and add-on objects has been updated with information about how to update an existing app using the CLI, and the "Learn more" help link maps to that topic.

jbsplunk
Splunk Employee
Splunk Employee

Generally speaking, if you are replacing props and transforms, a restart is going to be required. The exception to this, if I understand correctly, would be search time field extractions. Under the current configuration, I do not think that avoiding a restart is possible.

http://www.splunk.com/base/Documentation/5.0/admin/Propsconf

To use one or more of these configurations, copy the configuration block into
props.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.

twinspop
Influencer

So through normal command line methods, replace the corresponding files and issue a restart. It seems odd that I can add transforms.conf to a Splunk server via an app and not have to restart, but changing transforms.conf for that same app requires a restart. Anyway, thanks for your input.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...