Deployment Architecture

Disable visibility of app on Search Head Cluster

adalbor
Builder

Hey All,

I would like to turn of visibility for a number of apps on our search head cluster and could of sworn I could do it from the GUI then the change to replicate to the other cluster members but that doesn't appear to be working. I made the changes on the search head captain. Am I missing something or do I have to make the changes in the app.conf for all the apps and then push to the cluster?

Thanks,
Andrew

lroynsky
Explorer

As mentioned by Somesoni2, any changes you'd like to make to your SHC can be done from your deployer ($SPLUNK_HOME/etc/shcluster/apps). Go into the corresponding app.conf file (if there isn't one in local, check default). In the UI stanza there should be an is_visible attribute. Change that from a '1' to a '0' and push (splunk apply shcluster-bundle -target https://host:port).

somesoni2
Revered Legend

AFAIK, app level changes are not replicated. You would have to use SHC Deployer to make changes to apps (app.conf changes).

Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...