Deployment Architecture

How to exclude an app from being updated on shcluster?

Loves-to-Learn Everything

Hello splunk team,


I'm getting the following error while trying to deploy new app on our SH cluster. 




Error while creating deployable apps: Error compressing the temporary tarball: /opt/splunk/var/run/splunk/deploy.1805b9b8294a5b90.tmp/apps/SplunkEnterpriseSecuritySuite.bundle: No space left on device




While I do understand the error, my challenge is that I can't increase further the /opt/splunk partition. 
So my question for you guy is if it is possible to exclude SplunkEnterpriseSecuritySuite from the deployement without deleting it. In other words, can I tell splunk to just push a specific app without checking other app like we do it on HF for a specific Server Class?

Kind regards,

Labels (2)
0 Karma

Esteemed Legend

Hi @Senak,

the problem is that your bundle to deploy are too large, so you have to blacklist something, to reduce the bundle dimension.

You should see at in the sample section.



0 Karma

Loves-to-Learn Everything

thanks @gcusello ,

Is the following to be changed ?

excludeFromUpdate = <path>[,<path>]

Can you give me an example of how  to exclude  "my_app" for instance  knowing that i have a symbolic link on  /opt/splunk/etc/shcluster/app/my_app 


0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...