Splunk Enterprise

Updating App on SHC member via GUI

TheBravoSierra
Path Finder

An app was updated via the GUI on a SHC member. What exactly does the Splunkbase install do/check? What needs to be done to un-do any changes made? Is it just best to uninstall the app and redeploy from SHC deployer? Default/app.conf shows the old version number, which makes me think that the files weren't actually updated everywhere. Wondering the best route to proceed to fix the mistake. 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

It depends on the deployer push mode.

With the default "merge to default" mode you should be able to simply remove app/default and push it again from the deployer. There is one caveat though - the updated app might have simply behaved in a way unexpected by older version instances and - for example - generated different summaries or "upgraded" kvstore contents.

So it might not be that easy.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...