Splunk Enterprise Security

Splunk Enterprise Security: After upgrading, why do I receive error "Install cannot continue because some apps are configured to deny disablement"?

cdo_splunk
Splunk Employee
Splunk Employee

upgraded Splunk Enterprise Security (ES) from v4.5.2 and after restarting Splunk and navigating to the ES app, we receive the error:

"Install cannot continue because some apps are configured to deny disablement: SA-IdentityManagement,SAThreatIntelligence,Splunk_TA_windows,Splunk_TA_sourcefire,DA-ESS-ThreatIntelligence,DA-ESS-NetworkProtection,SA-EndpointProtection,DA-ESS-IdentityManagement,DA-ESS-EndpointProtection,DA-ESS-AccessProtection,Splunk_SA_CIM,SA-AccessProtection,Splunk_SA_ExtremeSearch,SA-UEBA,SA-Utils,TA-nmap,Splunk_TA_oracle,Splunk_TA_nix,SA-AuditAndDataProtection,Splunk_TA_ossec,SA-NetworkProtection"

0 Karma
1 Solution

cdo_splunk
Splunk Employee
Splunk Employee

To resolve the issue, try the step listed below:

[install]
allows_disable=true

Please do the same for all the apps that listed with the aboved errors and re-tried the upgrade

Splunkd daemon is not responding: (u"Error connecting to /services/apps/local/SA-IdentityManagement/enable: ('The read operation timed out',)",)
To fix this one, try the following step:
vi /opt/splunk/etc/apps/SA-IdentityManagement/local/app.conf
[install]
allows_disable = true
state = enabled <----deleted this line

Splunkd daemon is not responding: (u"Error connecting to /services/apps/local/DA-ESS-ThreatIntelligence/disable: ('The read operation timed out',)",)
To fix this one, try the following step:
vi /opt/splunk/etc/apps/SA-ThreatIntelligence/local/app.conf
[install]
allows_disable = true
state = disabled <-----------removed this line
saved & restarted splunk
ran setup again

View solution in original post

cdo_splunk
Splunk Employee
Splunk Employee

To resolve the issue, try the step listed below:

[install]
allows_disable=true

Please do the same for all the apps that listed with the aboved errors and re-tried the upgrade

Splunkd daemon is not responding: (u"Error connecting to /services/apps/local/SA-IdentityManagement/enable: ('The read operation timed out',)",)
To fix this one, try the following step:
vi /opt/splunk/etc/apps/SA-IdentityManagement/local/app.conf
[install]
allows_disable = true
state = enabled <----deleted this line

Splunkd daemon is not responding: (u"Error connecting to /services/apps/local/DA-ESS-ThreatIntelligence/disable: ('The read operation timed out',)",)
To fix this one, try the following step:
vi /opt/splunk/etc/apps/SA-ThreatIntelligence/local/app.conf
[install]
allows_disable = true
state = disabled <-----------removed this line
saved & restarted splunk
ran setup again

Get Updates on the Splunk Community!

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...