Getting Data In

Is configuration bundle used to remove an app or add-on?

scottrunyon
Contributor

We are moving to a new Anti-Virus vendor and I will need to add the add-on (TA) for the new vendor. My question concerns the old TA. If I remove the $SPLUNK_HOME/etc/master-apps/ section concerning the old vendor, does that remove the TA from the cluster nodes? Or am I going to have to delete the TA using "splunk remove app -auth user:PW" command?

0 Karma
1 Solution

adonio
Ultra Champion

Hi scottrunyon,
Splunk will work as you described, it will match the apps in .../master-apps on CM to the .../slave-apps on peers.
so you can safely remove old add-on and place new one, or just add the new one. more to read here:
https://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Updatepeerconfigurations
hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

Hi scottrunyon,
Splunk will work as you described, it will match the apps in .../master-apps on CM to the .../slave-apps on peers.
so you can safely remove old add-on and place new one, or just add the new one. more to read here:
https://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Updatepeerconfigurations
hope it helps

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...