Is there a way to disable a Splunk app using REST and CURL command?

[dineshraj9]

I want to disable a Splunk app using curl command and then enable it back. Is there a way to do it without restarting Splunk?

I couldn't find anything in the REST reference manual for Apps - http://docs.splunk.com/Documentation/Splunk/6.5.1/RESTREF/RESTapps

[martin_mueller · Accepted solution]

That's not documented there because it's documented more generally here: http://docs.splunk.com/Documentation/Splunk/6.5.1/RESTUM/RESTusing#Enable_and_disable_endpoint

Same principle applies for all disable-able objects.

[martin_mueller]

In an SHC you should distribute this via the SHC deployer.

[dineshraj9]

The endpoint works for disabling an app on the search head where I issue the CURL command, but the changes don't get replicated to any of the other peers in the SHC.

Is there some way I can disable it across all peers?
Do I need to issue the curl command on all peers?

[woodcock]

You can disable REST for the entire node but I don't think you can selectively.