Getting Data In

Is configuration bundle used to remove an app or add-on?

scottrunyon
Contributor

We are moving to a new Anti-Virus vendor and I will need to add the add-on (TA) for the new vendor. My question concerns the old TA. If I remove the $SPLUNK_HOME/etc/master-apps/ section concerning the old vendor, does that remove the TA from the cluster nodes? Or am I going to have to delete the TA using "splunk remove app -auth user:PW" command?

0 Karma
1 Solution

adonio
Ultra Champion

Hi scottrunyon,
Splunk will work as you described, it will match the apps in .../master-apps on CM to the .../slave-apps on peers.
so you can safely remove old add-on and place new one, or just add the new one. more to read here:
https://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Updatepeerconfigurations
hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

Hi scottrunyon,
Splunk will work as you described, it will match the apps in .../master-apps on CM to the .../slave-apps on peers.
so you can safely remove old add-on and place new one, or just add the new one. more to read here:
https://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Updatepeerconfigurations
hope it helps

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Transforming Financial Data into Fraud Intelligence

Every day, banks and financial companies handle millions of transactions, logins, and customer interactions ...

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...