Don't want Getting Started to come back each time I upgrade

[jgumbley]

I try and keep our production Splunk server on the latest maintenance release of Splunk.

Also I have removed the "getting started" app from the Launcher.

Each time I upgrade it returns, and I have to go back and delete it.

I could write a shell script - but if the name changes etc, this could be more problematic.

Is there a way to only upgrade the core of the app - and leave my applications be.

Cheers,

[gkanapathy · Accepted solution]

If you make any changes to a Splunk-delivered object or configuration, you should do it by overridding it in the corresponding "local" directory, not by modifying the item in "default". This mechanism is specifically in place to address changes across upgrades, and does include enabling apps and modification of UI pages.

You could (using the above method) also look at making the "getting started" app non-visible.