Deployment Architecture

Disable visibility of app on Search Head Cluster

adalbor
Builder

Hey All,

I would like to turn of visibility for a number of apps on our search head cluster and could of sworn I could do it from the GUI then the change to replicate to the other cluster members but that doesn't appear to be working. I made the changes on the search head captain. Am I missing something or do I have to make the changes in the app.conf for all the apps and then push to the cluster?

Thanks,
Andrew

lroynsky
Explorer

As mentioned by Somesoni2, any changes you'd like to make to your SHC can be done from your deployer ($SPLUNK_HOME/etc/shcluster/apps). Go into the corresponding app.conf file (if there isn't one in local, check default). In the UI stanza there should be an is_visible attribute. Change that from a '1' to a '0' and push (splunk apply shcluster-bundle -target https://host:port).

0 Karma

somesoni2
Revered Legend

AFAIK, app level changes are not replicated. You would have to use SHC Deployer to make changes to apps (app.conf changes).

Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...