I've found that upgrading a custom app built with Splunk Add-on Builder is clearing all configured data inputs. Is there a way to prevent this?
BUMP.
Hi @benhooper ,
My guess is, that the definitions / .conf files were stored in the ./default directory of the app and not ./local, so they were overwritten when the app was updated.
BR
Ralph
Hi @rnowitzki,
Good idea but I've just checked and found that this configuration is stored in file /opt/splunk/etc/apps/<app name>/local/inputs.conf.
Thanks,
Ben.
Hi @benhooper,
Hmm, ok. Is it stored in ./local within structure of the tar.gz of the app? That would be against the law 🙂
Or do you mean, the inputs.conf is still there in the filesystem, but you don't see it in the gui?
BR
Ralph
Hi @rnowitzki,
My previous message was in regards to where the active, correct configuration is stored.
Your message led me to look inside the archive and I found that, by default, the file <appName>_<appVersion>_export.tgz/<appName>_<appVersion>_export.tgz/<appName>/local/inputs.conf exists and contains the default / generic config. Simply deleting that file from the archive solves the problem because it can't be used to overwrite the live file.
Thanks!
Bonus points to anyone who can tell me how I can prevent these files from being exported in the first place! It's a nuisance having to manually remove them every time I export.
Hi @benhooper ,
You mean to prevent that the inputs.conf of the tar.gz overwrites the inputs.conf of the App?
The problem is with the archive itself, it should not have any inputs.conf in ./local. It should deliver its inputs.conf in the ./default directory. That way it would extract the new copy, but the app would still use the one in ./local because of conf file precedence rules.
Where is the app coming from?
BR
Ralph