Why is Splunk marking a custom TA as deprecated

[DMohn]

Hi Splunkers

We have built a custom technical add-on for our BlueCoat Appliances. Now Splunk is marking this TA as deprecated (Message: "Deprecated app TA-bluecoat is installed in the enabled state. Please uninstall this app using methods appropriate for your installation")

How can it be that Splunk marks a custom add-on as deprecated?

The app.conf setting check_for_updates is set to false - so there should be no check here.

Can we solve this somehow, as the message is quite nagging, and we are needing the TA?

Thanks for your advice.

[kmanson]

During installation the TA was marked as deprecated, as it should have been replaced by a new one. In my case I am specifically using an app that has the same name as a depreciated app.

To turn off the nagging alert I removed the app from this file.
/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/install/deprecated_apps.txt

[DMohn · Accepted solution]

I can give the answer myself here - after some thorough investigation...

The reason was our installation of the Splunk Enterprise Security Suite. During installation the TA was marked as deprecated, as it should have been replaced by a new one.

We have removed the app out of the ESS list of deprecated apps, and everything works fine!

[andrew_bostic1]

I guess a better question is how do you fix this? what needs to be updated to stop this error message?

[andrew_bostic1]

Where do you find the ESS list of deprecated apps?

[DMohn]

I found this in the ESS installation log under $SPLUNK_HOME$/var/log/splunk

[mreynov_splunk]

Not sure why the message, but perhaps you can use this TA instead: https://splunkbase.splunk.com/app/2758/

[jkat54]

I would assume it's been deprecated as per the Advanced XML deprecation (release 6.3+). Unfortunately I can only comment as I dont know how to disable the message as you desire.