Deployment Architecture

How to manually deploy splunk app on deployment client?

richnavis
Contributor

Hello, I would like to manually deploy a splunk TA app to a server that is configured to receive apps from it's deployment server. I am concerned that if I manually deploy an app, the deployment server will remove it next time the deployment client restarts. The reason I would like to do this is because the splunk TA that I am installing does not support deployment by the deployment server. Please advise how to work around this.

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

" the deployment server will remove it next time the deployment client restarts.

This will only happen if your deployment server is configured to send such an app (an empty app or an disabled version of it)
by default, it will not touch any local apps that are not "managed" by it's serverclass.conf

However, it can be an extra complexity later to manage if you have a mix of manual and automatically deployed apps.

View solution in original post

PowerPacked
Builder

Hi @ richnavis

Take a look if by adding this line to severclass.conf works for you.

excludeFromUpdate = location of your app.

Thanks

0 Karma

yannK
Splunk Employee
Splunk Employee

" the deployment server will remove it next time the deployment client restarts.

This will only happen if your deployment server is configured to send such an app (an empty app or an disabled version of it)
by default, it will not touch any local apps that are not "managed" by it's serverclass.conf

However, it can be an extra complexity later to manage if you have a mix of manual and automatically deployed apps.

richnavis
Contributor

Thanks yannK.... I went ahead and tested this and that is exactly what happens. Splunk does not remove it.

I agree that having a mixture of manual and auto apps could be confusing, and that is not what I'd prefer to do, but it appears the splunk documentation suggest that deploying the splunk_ta_aws app should'nt be done by the deployment server when deploying to the heavy forwarder. Anyway, your wisdom helped. Thanks!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...