- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi Splunkers
We have built a custom technical add-on for our BlueCoat Appliances. Now Splunk is marking this TA as deprecated (Message: "Deprecated app TA-bluecoat is installed in the enabled state. Please uninstall this app using methods appropriate for your installation")
How can it be that Splunk marks a custom add-on as deprecated?
The app.conf setting check_for_updates
is set to false
- so there should be no check here.
Can we solve this somehow, as the message is quite nagging, and we are needing the TA?
Thanks for your advice.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I can give the answer myself here - after some thorough investigation...
The reason was our installation of the Splunk Enterprise Security Suite. During installation the TA was marked as deprecated, as it should have been replaced by a new one.
We have removed the app out of the ESS list of deprecated apps, and everything works fine!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

During installation the TA was marked as deprecated, as it should have been replaced by a new one. In my case I am specifically using an app that has the same name as a depreciated app.
To turn off the nagging alert I removed the app from this file.
/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/install/deprecated_apps.txt
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I can give the answer myself here - after some thorough investigation...
The reason was our installation of the Splunk Enterprise Security Suite. During installation the TA was marked as deprecated, as it should have been replaced by a new one.
We have removed the app out of the ESS list of deprecated apps, and everything works fine!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I guess a better question is how do you fix this? what needs to be updated to stop this error message?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Where do you find the ESS list of deprecated apps?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I found this in the ESS installation log under $SPLUNK_HOME$/var/log/splunk
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Not sure why the message, but perhaps you can use this TA instead: https://splunkbase.splunk.com/app/2758/
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I would assume it's been deprecated as per the Advanced XML deprecation (release 6.3+). Unfortunately I can only comment as I dont know how to disable the message as you desire.
