Knowledge Management

How to disable update checking in Splunk server / where to locate app.conf?

jankowsr
Path Finder

Splunk 6.0.2 (build 196940), Ubuntu 12.04

I have seen
http://answers.splunk.com/answers/28616/how-can-automatic-update-checking-be-disabled-forsplunkbase-...

[...]

In the desired app's
$SPLUNK_HOME/etc/apps/<appname>local/app.conf
(if this does not
exist, create one) and include:

[package]
check_for_updates = 0

[...]

but I can't find out the <appname>.
I tried to create /opt/splunk/etc/apps/local/app.conf, issued /etc/init.d/splunk restart but no success (splunk is checking for updates)
I referred to
http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Appconf
and http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Configurationfiledirectories, especially the $SPLUNK_HOME/etc/apps/<app_name>/[local|default] paragraph
and still have no clue where my app.conf should be located. At the moment I have app.conf files in the following directories:

/opt/splunk/etc/apps/user-prefs/default/app.conf
/opt/splunk/etc/apps/launcher/default/app.conf
/opt/splunk/etc/apps/splunk_datapreview/default/app.conf
/opt/splunk/etc/apps/gettingstarted/default/app.conf
/opt/splunk/etc/apps/legacy/default/app.conf
/opt/splunk/etc/apps/search/default/app.conf
/opt/splunk/etc/apps/SplunkForwarder/default/app.conf
/opt/splunk/etc/apps/SplunkLightForwarder/default/app.conf
/opt/splunk/etc/apps/sample_app/default/app.conf
/opt/splunk/etc/apps/framework/server/apps/homefx/splunkd/default/app.conf
/opt/splunk/etc/apps/framework/server/apps/quickstartfx/splunkd/default/app.conf
/opt/splunk/etc/apps/framework/server/splunkdj/app_templates/basic/splunkd/default/app.conf
/opt/splunk/etc/apps/framework/server/splunkdj/app_templates/splunkweb/default/app.conf
Tags (1)
0 Karma
1 Solution

dmaislin_splunk
Splunk Employee
Splunk Employee

http://answers.splunk.com/answers/2116/how-can-i-disable-the-login-notification-message-that-a-new-s...

web.conf contains the setting from which you can disable Splunk
automatic checking for new versions:

By default the setting:

updateCheckerBaseURL = http://quickdraw.splunk.com/js/
To disable automatic checking, add to your $SPLUNK_HOME/etc/system/local/web.conf in

[settings]

updateCheckerBaseURL = 0
Note: Disabling this feature will apply to all Splunk non-admin and admin users.

For further information refer to:

http://www.splunk.com/base/Documentation/4.0.11/Admin/Webconf

View solution in original post

dmaislin_splunk
Splunk Employee
Splunk Employee

http://answers.splunk.com/answers/2116/how-can-i-disable-the-login-notification-message-that-a-new-s...

web.conf contains the setting from which you can disable Splunk
automatic checking for new versions:

By default the setting:

updateCheckerBaseURL = http://quickdraw.splunk.com/js/
To disable automatic checking, add to your $SPLUNK_HOME/etc/system/local/web.conf in

[settings]

updateCheckerBaseURL = 0
Note: Disabling this feature will apply to all Splunk non-admin and admin users.

For further information refer to:

http://www.splunk.com/base/Documentation/4.0.11/Admin/Webconf

dhergert
Engager

Am I the only one that finds it frustrating that of the ump-teen settings that can be changed via the UI, that this is not one of them?

jankowsr
Path Finder

If you are trying to disable the check at the login page, follow my original advice. It is not done in the app.conf at all.

Ok, that answers my question. It seems that I incorrectly assumed that this notification comes from one of the apps and it would be fine to add "check_for_updates = 0" in just one app.conf but it seems I was wrong. I probably should have read more carefully app.conf doc but maybe it would be worth to make make clear distinction between these two options and note that only updateCheckerBaseURL is responsible for notification at login page.
Thank you for your support.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

If you are doing this on a per app basis, then you add this to the app.conf in each local directory:

[package]
check_for_updates = 0

dmaislin_splunk
Splunk Employee
Splunk Employee

If you are trying to disable the check at the login page, follow my original advice. It is not done in the app.conf at all.

web.conf contains the setting from which you can disable Splunk
automatic checking for new versions:

By default the setting:
updateCheckerBaseURL = http://quickdraw.splunk.com/js/
To disable automatic checking, add to your $SPLUNK_HOME/etc/system/local/web.conf in

[settings]

updateCheckerBaseURL = 0
Note: Disabling this feature will apply to all Splunk non-admin and admin users.

http://www.splunk.com/base/Documentation/4.0.11/Admin/Webconf

0 Karma

jankowsr
Path Finder

In /opt/splunk/etc/apps I have 12 subfolders. You mean I should create in EACH of them "local" folder and in EVERY "local" folder create app.conf file (if not exists) and add "check_for_updates = 0" entry in ALL 12 app.conf files to get rid of update notification at login page?

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Now you do understand that I meant for every single app that is under $SPLUNK_HOME/etc/apps, you have to go into each app, create a local folder, and in that local folder put or update the app.conf there.

DO NOT create an APPNAME folder. Does that make sense?

0 Karma

jankowsr
Path Finder

ok, that's what i did:

# mkdir -p /opt/splunk/etc/apps/APPNAME/local
# echo -e "[package]\ncheck_for_updates = 0\n" > /opt/splunk/etc/apps/APPNAME/local/app.conf
# cat /opt/splunk/etc/apps/APPNAME/local/app.conf
[package]
check_for_updates = 0

# /etc/init.d/splunk restart

... logged in to splunk and it is still checking for updates.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

So it works like this. In $SPLUNK_HOME/etc/apps/APPNAME there is a default folder for each app. Don't mess with that. In the $SPLUNK_HOME/etc/apps/APPNAME you can create a folder called local, i.e.: $SPLUNK_HOME/etc/apps/APPNAME/local with an app.conf file in there if it doesn't already exist. In any case, just add this one line:

check_for_updates = 0

Then restart Splunk.

0 Karma

jankowsr
Path Finder

This is correct but I want to use check_for_update option from app.conf file and I don't know where app.conf should be located. Apologize if I was not clear enough in previous posts.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

I am confused because you said yes to the question of: You want to disable the Splunk update check that happens at login page?

0 Karma

jankowsr
Path Finder

I have seen updateCheckerBaseURL and updateCheckerBaseURL options but they are part of the web.conf and my question corresponds to app.conf

0 Karma

jankowsr
Path Finder

Yes, this is correct.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You want to disable the Splunk update check that happens at login page?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...