Getting Data In

Is there a way to disable a Splunk app using REST and CURL command?

Builder

I want to disable a Splunk app using curl command and then enable it back. Is there a way to do it without restarting Splunk?

I couldn't find anything in the REST reference manual for Apps - http://docs.splunk.com/Documentation/Splunk/6.5.1/RESTREF/RESTapps

0 Karma
1 Solution

SplunkTrust
SplunkTrust

That's not documented there because it's documented more generally here: http://docs.splunk.com/Documentation/Splunk/6.5.1/RESTUM/RESTusing#Enable_and_disable_endpoint

Same principle applies for all disable-able objects.

View solution in original post

SplunkTrust
SplunkTrust

That's not documented there because it's documented more generally here: http://docs.splunk.com/Documentation/Splunk/6.5.1/RESTUM/RESTusing#Enable_and_disable_endpoint

Same principle applies for all disable-able objects.

View solution in original post

SplunkTrust
SplunkTrust

In an SHC you should distribute this via the SHC deployer.

0 Karma

Builder

The endpoint works for disabling an app on the search head where I issue the CURL command, but the changes don't get replicated to any of the other peers in the SHC.

Is there some way I can disable it across all peers?
Do I need to issue the curl command on all peers?

0 Karma

Esteemed Legend

You can disable REST for the entire node but I don't think you can selectively.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!