Is there a way to avoid the custom dashboards from getting wiped out after a Splunk upgrade or a Deployment Server restart? I tried the excludeFromUpdate option in the serverclass.conf file of the deployment server, but want to know if there is any other solution apart from that.
We finally fixed the issue by moving the app configurations to the default directory and letting customers use local directory for creating dashboards. Additionally, we have added excludeFromUpdate option for the local directory.
Splunk puts its configurations under default directory and we are advised to add our configs under local directory.
If you have created a splunk app for aiding custom dashboard creation, then you should put your configurations under /default directory. That way when you provide further upgrades to the app, the end user created dashboards will stay unaffected.
Adding excludeFromUpdate is not the solution. This may stop you from providing updates to the app that you have created.
just moving things to default directory might work in case of new installations and not on existing upgrade ones. So we need to use a combination of both putting configurations in default directory and adding excludeFromUpdate for the local directory.
If you are going to continue maintaining the local directory in your app then fine. If the solution is going to be taking out local fully and maintaining only default in the app, then it makes sense once to test without including excludeFromUpdate
Upgrading Splunk should have no effect on your custom dashboards unless you put them in $SPLUNK_HOME/etc/system/default against all advice.