How to exclude an app from being updated on shcluster?

[Senak]

Hello splunk team,

I'm getting the following error while trying to deploy new app on our SH cluster. 

Error while creating deployable apps: Error compressing the temporary tarball: /opt/splunk/var/run/splunk/deploy.1805b9b8294a5b90.tmp/apps/SplunkEnterpriseSecuritySuite.bundle: No space left on device

While I do understand the error, my challenge is that I can't increase further the /opt/splunk partition. 
So my question for you guy is if it is possible to exclude SplunkEnterpriseSecuritySuite from the deployement without deleting it. In other words, can I tell splunk to just push a specific app without checking other app like we do it on HF for a specific Server Class?

Kind regards,

[gcusello]

Hi @Senak,

the problem is that your bundle to deploy are too large, so you have to blacklist something, to reduce the bundle dimension.

You should see at https://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverclassconf in the sample section.

Ciao.

Giuseppe

[Senak]

thanks @gcusello ,

Is the following to be changed ?

excludeFromUpdate = <path>[,<path>]

Can you give me an example of how  to exclude  "my_app" for instance  knowing that i have a symbolic link on  /opt/splunk/etc/shcluster/app/my_app 

Regards