Deployment Architecture

Disable visibility of app on Search Head Cluster

Builder

Hey All,

I would like to turn of visibility for a number of apps on our search head cluster and could of sworn I could do it from the GUI then the change to replicate to the other cluster members but that doesn't appear to be working. I made the changes on the search head captain. Am I missing something or do I have to make the changes in the app.conf for all the apps and then push to the cluster?

Thanks,
Andrew

Explorer

As mentioned by Somesoni2, any changes you'd like to make to your SHC can be done from your deployer ($SPLUNKHOME/etc/shcluster/apps). Go into the corresponding app.conf file (if there isn't one in local, check default). In the UI stanza there should be an isvisible attribute. Change that from a '1' to a '0' and push (splunk apply shcluster-bundle -target https://host:port).

0 Karma

SplunkTrust
SplunkTrust

AFAIK, app level changes are not replicated. You would have to use SHC Deployer to make changes to apps (app.conf changes).