Deployment Architecture

Disable visibility of app on Search Head Cluster

adalbor
Builder

Hey All,

I would like to turn of visibility for a number of apps on our search head cluster and could of sworn I could do it from the GUI then the change to replicate to the other cluster members but that doesn't appear to be working. I made the changes on the search head captain. Am I missing something or do I have to make the changes in the app.conf for all the apps and then push to the cluster?

Thanks,
Andrew

lroynsky
Explorer

As mentioned by Somesoni2, any changes you'd like to make to your SHC can be done from your deployer ($SPLUNK_HOME/etc/shcluster/apps). Go into the corresponding app.conf file (if there isn't one in local, check default). In the UI stanza there should be an is_visible attribute. Change that from a '1' to a '0' and push (splunk apply shcluster-bundle -target https://host:port).

somesoni2
Revered Legend

AFAIK, app level changes are not replicated. You would have to use SHC Deployer to make changes to apps (app.conf changes).

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...