Splunk Enterprise Security

Splunk Enterprise Security: After upgrading, why do I receive error "Install cannot continue because some apps are configured to deny disablement"?

cdo_splunk
Splunk Employee
Splunk Employee

upgraded Splunk Enterprise Security (ES) from v4.5.2 and after restarting Splunk and navigating to the ES app, we receive the error:

"Install cannot continue because some apps are configured to deny disablement: SA-IdentityManagement,SAThreatIntelligence,Splunk_TA_windows,Splunk_TA_sourcefire,DA-ESS-ThreatIntelligence,DA-ESS-NetworkProtection,SA-EndpointProtection,DA-ESS-IdentityManagement,DA-ESS-EndpointProtection,DA-ESS-AccessProtection,Splunk_SA_CIM,SA-AccessProtection,Splunk_SA_ExtremeSearch,SA-UEBA,SA-Utils,TA-nmap,Splunk_TA_oracle,Splunk_TA_nix,SA-AuditAndDataProtection,Splunk_TA_ossec,SA-NetworkProtection"

0 Karma
1 Solution

cdo_splunk
Splunk Employee
Splunk Employee

To resolve the issue, try the step listed below:

[install]
allows_disable=true

Please do the same for all the apps that listed with the aboved errors and re-tried the upgrade

Splunkd daemon is not responding: (u"Error connecting to /services/apps/local/SA-IdentityManagement/enable: ('The read operation timed out',)",)
To fix this one, try the following step:
vi /opt/splunk/etc/apps/SA-IdentityManagement/local/app.conf
[install]
allows_disable = true
state = enabled <----deleted this line

Splunkd daemon is not responding: (u"Error connecting to /services/apps/local/DA-ESS-ThreatIntelligence/disable: ('The read operation timed out',)",)
To fix this one, try the following step:
vi /opt/splunk/etc/apps/SA-ThreatIntelligence/local/app.conf
[install]
allows_disable = true
state = disabled <-----------removed this line
saved & restarted splunk
ran setup again

View solution in original post

cdo_splunk
Splunk Employee
Splunk Employee

To resolve the issue, try the step listed below:

[install]
allows_disable=true

Please do the same for all the apps that listed with the aboved errors and re-tried the upgrade

Splunkd daemon is not responding: (u"Error connecting to /services/apps/local/SA-IdentityManagement/enable: ('The read operation timed out',)",)
To fix this one, try the following step:
vi /opt/splunk/etc/apps/SA-IdentityManagement/local/app.conf
[install]
allows_disable = true
state = enabled <----deleted this line

Splunkd daemon is not responding: (u"Error connecting to /services/apps/local/DA-ESS-ThreatIntelligence/disable: ('The read operation timed out',)",)
To fix this one, try the following step:
vi /opt/splunk/etc/apps/SA-ThreatIntelligence/local/app.conf
[install]
allows_disable = true
state = disabled <-----------removed this line
saved & restarted splunk
ran setup again

Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...