Getting Data In

Is configuration bundle used to remove an app or add-on?

scottrunyon
Contributor

We are moving to a new Anti-Virus vendor and I will need to add the add-on (TA) for the new vendor. My question concerns the old TA. If I remove the $SPLUNK_HOME/etc/master-apps/ section concerning the old vendor, does that remove the TA from the cluster nodes? Or am I going to have to delete the TA using "splunk remove app -auth user:PW" command?

0 Karma
1 Solution

adonio
Ultra Champion

Hi scottrunyon,
Splunk will work as you described, it will match the apps in .../master-apps on CM to the .../slave-apps on peers.
so you can safely remove old add-on and place new one, or just add the new one. more to read here:
https://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Updatepeerconfigurations
hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

Hi scottrunyon,
Splunk will work as you described, it will match the apps in .../master-apps on CM to the .../slave-apps on peers.
so you can safely remove old add-on and place new one, or just add the new one. more to read here:
https://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Updatepeerconfigurations
hope it helps

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...