Splunk upgraded to 7.0.0 from Linux but message still shows new version available?

[wuming79]

Hi,

I have upgraded my Splunk to 7.0.0 from Linux terminal. Terminal shows version is not 7.0.0. Web interface->about also reflected 7.0.0 but there are still messages showing a new version and new maintenance versions are available. Is this a bug?

[wuming79]

Hi, somehow when I log in now, the message is gone. I haven't start to work on the web.conf. I guess it takes some time for web interface to update the messages...

[inventsekar]

oh that is great.. maybe, just for learning, you can use the find command list on the below comment and check that web.conf file.. if in future needed, you can edit it. maybe, you can accept the below answer as well 😉

[inventsekar · Accepted solution]

from a similar post, web.conf contains the setting from which you can disable Splunk automatic checking for new versions:

By default the setting is:

updateCheckerBaseURL = http://quickdraw.splunk.com/js/

To disable automatic checking, add to your
$SPLUNK_HOME/etc/system/local/web.conf:

[settings]
updateCheckerBaseURL = 0
Note: Disabling this feature will apply to all Splunk non-admin and admin users.

For further information refer to:

http://www.splunk.com/base/Documentation/4.0.11/Admin/Webconf

or a related topic on suppressing messages for non-admin users.

For the free version of Splunk the webconf is located here.
$SPLUNK_HOME/etc/system/default/web.conf

The setting below is the same.
`[settings]

modify this

updateCheckerBaseURL = http://quickdraw.splunk.com/js/

to

updateCheckerBaseURL = 0`

[wuming79]

my /opt/splunk/etc/system/default has web.conf and updateCheckerBaseURL = http://quickdraw.splunk.com/js/, but I guess I don't need to change anything now. Thanks.

[wuming79]

Hi inventsekar,

Thanks for the terminal tips.

I found 3 web.conf under opt/splunk:

1. opt/splunk/etc/apps/SplunkLightForwarder/default/web.conf
2. opt/splunk/etc/apps/Splunk_instrumentation/default/web.conf
3. opt/splunk/etc/system/default/web.conf

Which one is the one that I should change in future? Do I copy the default, create a local folder under $SPLUNK_HOME/etc/system/local/web.conf or I can wok directly with the one in $SPLUNK_HOME/etc/system/default/web.conf?

what does opt and $SPLUNK_HOME has to do with each other?

[rpquinlan]

To answer your last question first:

" what does opt and $SPLUNK_HOME has to do with each other?

--$SPLUNK_HOME is used in documentation because that's a variable part of your install. You could have installed Splunk where you did (/opt/splunk), or you could have installed it elsewhere (like /opt/apps/splunk), so to keep things consistent, $SPLUNK_HOME is used to represent the directory path to where your installation of splunk is - in your case, /opt/splunk

--It's a best practice to never change any of the files in the "default" directory (whether that's system/default, apps/xxx/default, or anything like that), as they can be overwritten with every upgrade.

In your case, you're on the right track - copy your /opt/splunk/etc/system/default/web.conf (or as it's said, $SPLUNK_HOME/etc/system/default/web.conf) file to $SPLUNK_HOME/etc/system/local. Then, delete everything you're NOT changing, leaving only the modified "updateCheckerBaseURL" field.

Although you're not experiencing the problem anymore, the above about not modifying files in the "default" directory is quite important to pay attention to, so I wanted to add that..

[wuming79]

my /opt/splunk/etc/system/local did not have the web.conf file. I could not check my settings there.

[inventsekar]

maybe, just search for web.conf
find /opt/splunk/etc/ -name "web.conf"