Getting Data In

Why is Splunk marking a custom TA as deprecated

Motivator

Hi Splunkers

We have built a custom technical add-on for our BlueCoat Appliances. Now Splunk is marking this TA as deprecated (Message: "Deprecated app TA-bluecoat is installed in the enabled state. Please uninstall this app using methods appropriate for your installation")

How can it be that Splunk marks a custom add-on as deprecated?

The app.conf setting check_for_updates is set to false - so there should be no check here.

Can we solve this somehow, as the message is quite nagging, and we are needing the TA?

Thanks for your advice.

0 Karma
1 Solution

Motivator

I can give the answer myself here - after some thorough investigation...

The reason was our installation of the Splunk Enterprise Security Suite. During installation the TA was marked as deprecated, as it should have been replaced by a new one.

We have removed the app out of the ESS list of deprecated apps, and everything works fine!

View solution in original post

Path Finder

During installation the TA was marked as deprecated, as it should have been replaced by a new one. In my case I am specifically using an app that has the same name as a depreciated app.

To turn off the nagging alert I removed the app from this file.
/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/install/deprecated_apps.txt

Motivator

I can give the answer myself here - after some thorough investigation...

The reason was our installation of the Splunk Enterprise Security Suite. During installation the TA was marked as deprecated, as it should have been replaced by a new one.

We have removed the app out of the ESS list of deprecated apps, and everything works fine!

View solution in original post

New Member

I guess a better question is how do you fix this? what needs to be updated to stop this error message?

0 Karma

New Member

Where do you find the ESS list of deprecated apps?

0 Karma

Motivator

I found this in the ESS installation log under $SPLUNK_HOME$/var/log/splunk

0 Karma

Splunk Employee
Splunk Employee

Not sure why the message, but perhaps you can use this TA instead: https://splunkbase.splunk.com/app/2758/

0 Karma

SplunkTrust
SplunkTrust

I would assume it's been deprecated as per the Advanced XML deprecation (release 6.3+). Unfortunately I can only comment as I dont know how to disable the message as you desire.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!