How to disable update checking in Splunk server / where to locate app.conf?

[jankowsr]

Splunk 6.0.2 (build 196940), Ubuntu 12.04

I have seen
http://answers.splunk.com/answers/28616/how-can-automatic-update-checking-be-disabled-forsplunkbase-...

[...]

In the desired app's
$SPLUNK_HOME/etc/apps/<appname>local/app.conf
(if this does not
exist, create one) and include:

[package]
check_for_updates = 0

[...]

but I can't find out the <appname>.
I tried to create /opt/splunk/etc/apps/local/app.conf, issued /etc/init.d/splunk restart but no success (splunk is checking for updates)
I referred to
http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Appconf
and http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Configurationfiledirectories, especially the $SPLUNK_HOME/etc/apps/<app_name>/[local|default] paragraph
and still have no clue where my app.conf should be located. At the moment I have app.conf files in the following directories:

/opt/splunk/etc/apps/user-prefs/default/app.conf
/opt/splunk/etc/apps/launcher/default/app.conf
/opt/splunk/etc/apps/splunk_datapreview/default/app.conf
/opt/splunk/etc/apps/gettingstarted/default/app.conf
/opt/splunk/etc/apps/legacy/default/app.conf
/opt/splunk/etc/apps/search/default/app.conf
/opt/splunk/etc/apps/SplunkForwarder/default/app.conf
/opt/splunk/etc/apps/SplunkLightForwarder/default/app.conf
/opt/splunk/etc/apps/sample_app/default/app.conf
/opt/splunk/etc/apps/framework/server/apps/homefx/splunkd/default/app.conf
/opt/splunk/etc/apps/framework/server/apps/quickstartfx/splunkd/default/app.conf
/opt/splunk/etc/apps/framework/server/splunkdj/app_templates/basic/splunkd/default/app.conf
/opt/splunk/etc/apps/framework/server/splunkdj/app_templates/splunkweb/default/app.conf

[dmaislin_splunk · Accepted solution]

http://answers.splunk.com/answers/2116/how-can-i-disable-the-login-notification-message-that-a-new-s...

web.conf contains the setting from which you can disable Splunk
automatic checking for new versions:

By default the setting:

updateCheckerBaseURL = http://quickdraw.splunk.com/js/
To disable automatic checking, add to your $SPLUNK_HOME/etc/system/local/web.conf in

[settings]

updateCheckerBaseURL = 0
Note: Disabling this feature will apply to all Splunk non-admin and admin users.

For further information refer to:

http://www.splunk.com/base/Documentation/4.0.11/Admin/Webconf

[dhergert]

Am I the only one that finds it frustrating that of the ump-teen settings that can be changed via the UI, that this is not one of them?

[jankowsr]

If you are trying to disable the check at the login page, follow my original advice. It is not done in the app.conf at all.

Ok, that answers my question. It seems that I incorrectly assumed that this notification comes from one of the apps and it would be fine to add "check_for_updates = 0" in just one app.conf but it seems I was wrong. I probably should have read more carefully app.conf doc but maybe it would be worth to make make clear distinction between these two options and note that only updateCheckerBaseURL is responsible for notification at login page.
Thank you for your support.

[dmaislin_splunk]

If you are doing this on a per app basis, then you add this to the app.conf in each local directory:

[package]
check_for_updates = 0

[dmaislin_splunk]

If you are trying to disable the check at the login page, follow my original advice. It is not done in the app.conf at all.

web.conf contains the setting from which you can disable Splunk
automatic checking for new versions:

By default the setting:
updateCheckerBaseURL = http://quickdraw.splunk.com/js/
To disable automatic checking, add to your $SPLUNK_HOME/etc/system/local/web.conf in

[settings]

updateCheckerBaseURL = 0
Note: Disabling this feature will apply to all Splunk non-admin and admin users.

http://www.splunk.com/base/Documentation/4.0.11/Admin/Webconf

[jankowsr]

In /opt/splunk/etc/apps I have 12 subfolders. You mean I should create in EACH of them "local" folder and in EVERY "local" folder create app.conf file (if not exists) and add "check_for_updates = 0" entry in ALL 12 app.conf files to get rid of update notification at login page?

[dmaislin_splunk]

Now you do understand that I meant for every single app that is under $SPLUNK_HOME/etc/apps, you have to go into each app, create a local folder, and in that local folder put or update the app.conf there.

DO NOT create an APPNAME folder. Does that make sense?

[jankowsr]

ok, that's what i did:

# mkdir -p /opt/splunk/etc/apps/APPNAME/local
# echo -e "[package]\ncheck_for_updates = 0\n" > /opt/splunk/etc/apps/APPNAME/local/app.conf
# cat /opt/splunk/etc/apps/APPNAME/local/app.conf
[package]
check_for_updates = 0

# /etc/init.d/splunk restart

... logged in to splunk and it is still checking for updates.

[dmaislin_splunk]

So it works like this. In $SPLUNK_HOME/etc/apps/APPNAME there is a default folder for each app. Don't mess with that. In the $SPLUNK_HOME/etc/apps/APPNAME you can create a folder called local, i.e.: $SPLUNK_HOME/etc/apps/APPNAME/local with an app.conf file in there if it doesn't already exist. In any case, just add this one line:

check_for_updates = 0

Then restart Splunk.

[jankowsr]

This is correct but I want to use check_for_update option from app.conf file and I don't know where app.conf should be located. Apologize if I was not clear enough in previous posts.

[dmaislin_splunk]

I am confused because you said yes to the question of: You want to disable the Splunk update check that happens at login page?

[jankowsr]

I have seen updateCheckerBaseURL and updateCheckerBaseURL options but they are part of the web.conf and my question corresponds to app.conf

[jankowsr]

Yes, this is correct.

[somesoni2]

You want to disable the Splunk update check that happens at login page?