Splunk Search

Splunk apps problem

Splunk_U
Path Finder

I am getting an apps in the SPLUNK web ui named abc...but when ever I am going to $SPLUNK_HOME/etc/apps, that abc app is not present there. What could be the cause?

Tags (1)
0 Karma

aholzer
Motivator

Go to manager > apps > find the abc app, and click the "view objects" link on that line.

What is your end goal with this app? Are you trying to make it so it doesn't show up anymore? Consider disabling it, or setting it to "visible" - no.

0 Karma

Splunk_U
Path Finder

I have looked up the object links for abc...nothing is prset under Manager>All configurations for the abc app

0 Karma

aholzer
Motivator

Look up the objects linked to the app, and then look for the files that define those objects.

0 Karma

Splunk_U
Path Finder

I have cheked all the app.conf file present on that particular server but did not get anywhere abc. Even tried to get abc as a folder or as a word in the server but did not find it.

0 Karma

aholzer
Motivator

Don't know if you noticed my comment before the clarification, but here it is again just in case:

"In which case you should use Ayn's hints and run a search for files named app.conf on the server where you have your Splunk installation. Then look through the files for one that is either in a folder "abc" or contains "abc" in it."

0 Karma

Splunk_U
Path Finder

Yes...both the name and the folder name is abc....but there is no directory named abc under $SPLUNK_HOME/etc/apps

0 Karma

aholzer
Motivator

Also just to clarify, you are saying that in the manager > apps page, you have an app that has the value "abc" under both the name and folder name columns, correct?

0 Karma

aholzer
Motivator

In which case you should use Ayn's hints and run a search for files named app.conf on the server where you have your Splunk installation. Then look through the files for one that is either in a folder "abc" or contains "abc" in it.

0 Karma

Splunk_U
Path Finder

I have tried the above steps...there also the name is abc but not able to find abc folder under $SPLUNK_HOME/etc/apps

0 Karma

aholzer
Motivator

If you go to manager > apps > "edit properties" for the app named "abc", at the top it will tell you what the "behind the scenes" name of the app is - as in where you'll find it in the etc/apps directory.

You will also be able to change what is being displayed as the app name, under the "name" field for the app.

Hope this helps.

0 Karma

Ayn
Legend

The app's label is defined in the app's app.conf so you'd have to look at the label string there rather than the app's directory name to find which of them is "abc".

0 Karma

Splunk_U
Path Finder

as there is no app named abc at $SPLUNK_HOME/etc/apps so app.config file is also not present there

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...