Deployment Architecture

How do I make Deployment Server forget about an app it is managing?

Ellen
Splunk Employee
Splunk Employee

One of my managed apps via Deployment Server is the Search app. Now, due to requirement changes, each Deployment client needs to allow its users to save searches. How do I make it forget about managing the Search, or any other app?

Tags (1)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

First keep in mind for any app that you decide to manage via the Deployment Server, the server will maintain information that it is a managed app forever. There is not a way to change that.

So carefully consider managing a key app such as the Search app to whether you really want Deployment Server to manage it in your environment.
It is not recommended unless you always want a consistent and unified Search app across your architecture.

The Search app would not be a good candidate since consider the ability of the client to create saved searches which means a modified savedsearches.conf This will be problematic as the next push from the Deployment Server's version of the Search app will not include those new searches and the client has essential lost its saved searches.

So if you inadvertently added the Search app to eg. $SPLUNK_HOME/etc/deployment-apps and want to "remove" it, you will have to do the following workaround

1) Remove the Search app from your deployment server configuration, and it will disappear from your clients.

2) From the Deployment Server Splunk instance or elsewhere, create a tarball of the Search app and manually unpack it to each client's $SPLUNK_HOME/etc/apps/search directory where the Search app no longer exists.

By doing this, the Deployment Server will no longer be managing the Search app, but you'll have a working copy of Search on the desired instance.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

First keep in mind for any app that you decide to manage via the Deployment Server, the server will maintain information that it is a managed app forever. There is not a way to change that.

So carefully consider managing a key app such as the Search app to whether you really want Deployment Server to manage it in your environment.
It is not recommended unless you always want a consistent and unified Search app across your architecture.

The Search app would not be a good candidate since consider the ability of the client to create saved searches which means a modified savedsearches.conf This will be problematic as the next push from the Deployment Server's version of the Search app will not include those new searches and the client has essential lost its saved searches.

So if you inadvertently added the Search app to eg. $SPLUNK_HOME/etc/deployment-apps and want to "remove" it, you will have to do the following workaround

1) Remove the Search app from your deployment server configuration, and it will disappear from your clients.

2) From the Deployment Server Splunk instance or elsewhere, create a tarball of the Search app and manually unpack it to each client's $SPLUNK_HOME/etc/apps/search directory where the Search app no longer exists.

By doing this, the Deployment Server will no longer be managing the Search app, but you'll have a working copy of Search on the desired instance.

Ellen
Splunk Employee
Splunk Employee

An enhancement exists for a feature to allow disabling an app that was tagged for deployment server management (ENH-4392)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...