Deployment Architecture

Disable visibility of app on Search Head Cluster

adalbor
Builder

Hey All,

I would like to turn of visibility for a number of apps on our search head cluster and could of sworn I could do it from the GUI then the change to replicate to the other cluster members but that doesn't appear to be working. I made the changes on the search head captain. Am I missing something or do I have to make the changes in the app.conf for all the apps and then push to the cluster?

Thanks,
Andrew

lroynsky
Explorer

As mentioned by Somesoni2, any changes you'd like to make to your SHC can be done from your deployer ($SPLUNK_HOME/etc/shcluster/apps). Go into the corresponding app.conf file (if there isn't one in local, check default). In the UI stanza there should be an is_visible attribute. Change that from a '1' to a '0' and push (splunk apply shcluster-bundle -target https://host:port).

0 Karma

somesoni2
Revered Legend

AFAIK, app level changes are not replicated. You would have to use SHC Deployer to make changes to apps (app.conf changes).

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...