Can you disable an app with an app?

[mkinner]

Using Splunk server & clients running 4.1.2. When I installed Splunk on our many clients I enabled the SplunkLightForwarder app. All other configurations are made via the deployment server client model. Now I need to disable SplunkLightForwarder so I can deploy a customized version of the SplunkLightForwarder. Rather than touching all of our Splunk clients, is there a way to deploy an app that can disable the SplunkLightForwarder.

[Lowell]

You may want to consider creating your own empty SplunkLightForwarder app, and then deploying that app to your clients. This is pretty similar to what Simeon was pointing out, except I would suggest just making a "blank" app (which I think is slightly more obvious what's going on. You could even put a simple little "README" file in there that notes that you have intentionally wiped out this app) rather than starting with a real copy of SplunkLightForwarder.

This topic is covered well in the Apps: Disable or Delete? post.

[mkinner]

Thank you Lowell!

[Simeon]

I would not recommend attempting to disable an app via another app, or try to force apps to contend with their configurations.

There are multiple ways to enable/disable an app. Manually, you would edit the app.conf file within the specific app and set the state parameter to be enabled (or disabled). If you are using the deployment server, it would make sense to just modify the app.conf for the SplunkLightForwarder to use a disabled setting in the local directory.

[mkinner]

Thank you Simeon!