Splunk 10.2.x | RHEL 8 | SPL2 disable or exposure

[NullZero]

IHAC that is eager to take advantage of the new Splunk Enterprise 10.2 release, they are currently on 10.0.3 and have already dealt with all the pain of the KVstore migrations 4.x > 7.x etc. Their underlying platform is RHEL 8 and I note the references that explain that SPL2 is not supported using RHEL 8.

The client rightly asks if SPL2 can be disabled OR if there is a stability exposure here should a user attempt to run SPL2. I note the guide that custom SPL2 can be managed and disabled etc but for default apps this is additional work.

Does anybody have experience or guidance in this use case please?

[NullZero]

Hi @livehybrid thanks for your reply and apologies if I was slow to acknowledge; I did implement this at the client but it still shows up in search and reporting, there has been no impact as when I simulate clicking on SPL2, it just waits a few seconds and then pops up with a failed to load module.

So, I can't quite accept as a solution but I recognise the helpfulness.

[livehybrid]

Hi @NullZero 

You can set the following in web-features.conf - This disabled the SPL2 dropdown in search and the options in Dashboard Studio.

[feature:spl2]
enable_spl2 = false

[feature:dashboard_studio]
activate_spl2_datasources = false

There is also a limits.conf setting but I dont think its required if the above 2 settings are applied but you could add for belt and braces? This prevents SPL2 searches being run from any origin.

# limits.conf
[spl2]
origin = none

  However - these changes do not remove the 'Modules' link in the Settings dropdown however it does provide a message when the SPL2 modules page is loaded to state it has been disabled.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing