Disable visibility of app on Search Head Cluster

[adalbor]

Hey All,

I would like to turn of visibility for a number of apps on our search head cluster and could of sworn I could do it from the GUI then the change to replicate to the other cluster members but that doesn't appear to be working. I made the changes on the search head captain. Am I missing something or do I have to make the changes in the app.conf for all the apps and then push to the cluster?

Thanks,
Andrew

[lroynsky]

As mentioned by Somesoni2, any changes you'd like to make to your SHC can be done from your deployer ($SPLUNK_HOME/etc/shcluster/apps). Go into the corresponding app.conf file (if there isn't one in local, check default). In the UI stanza there should be an is_visible attribute. Change that from a '1' to a '0' and push (splunk apply shcluster-bundle -target https://host:port).

[somesoni2]

AFAIK, app level changes are not replicated. You would have to use SHC Deployer to make changes to apps (app.conf changes).