I've created a very simple app that contains only a transforms file and props file. I want to update the files with some new values. If I re-package the tgz and try to upload, Splunk tells me the app already exists. The link to "You can replace an existing app via the Splunk CLI. Learn more" doesn't help. It provides help on disabling or uninstalling an app via the CLI. No mention of replacing.
I don't have a deployment server yet.
I'm trying to avoid a Splunk restart. Is that possible?
Just another turn on this. If you use version.. 4.3 upwards I think (perhaps 4.3.1) there is actually now a tick box to select that the upload is an upgrade and it will copy the old default configs to a backup directory and install the latest version.
A restart will only be required if you are doing any endpoint magic or register brand new configs.
Generally speaking, if you are replacing props and transforms, a restart is going to be required. The exception to this, if I understand correctly, would be search time field extractions. Under the current configuration, I do not think that avoiding a restart is possible.
To use one or more of these configurations, copy the configuration block into props.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.
So through normal command line methods, replace the corresponding files and issue a restart. It seems odd that I can add transforms.conf to a Splunk server via an app and not have to restart, but changing transforms.conf for that same app requires a restart. Anyway, thanks for your input.