Turn off Splunk Assist in search head cluster and heavy forwarders connected do deployment server

[bitnapper]

Hi, 

Splunk Assist is producing a lot of execution errors in my search head cluster and on my intermediate forwarder. Since the first is part of a cluster I thought of deploying the app.conf via shc-d but that would not be enough since do doku say one must execute ./splunk disable app splunk_assist. Similar for heavy forwarders connected to a deployment server. Sadly the splunk doku on Splunk Assist doesnt seem to care that clustered environments exists.

Kind Regards

th

[richgalloway]

Disabling an app in the UI should disable it in all SHC member nodes.  To disable it on the HFs, set state=disabled in the [install] stanza of $SPLUNK_HOME/etc/deployment-apps/splunk_assist/local/app.conf and wait for the HFs to download the update.