Splunk Enterprise

Updating App on SHC member via GUI

TheBravoSierra
Path Finder

An app was updated via the GUI on a SHC member. What exactly does the Splunkbase install do/check? What needs to be done to un-do any changes made? Is it just best to uninstall the app and redeploy from SHC deployer? Default/app.conf shows the old version number, which makes me think that the files weren't actually updated everywhere. Wondering the best route to proceed to fix the mistake. 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

It depends on the deployer push mode.

With the default "merge to default" mode you should be able to simply remove app/default and push it again from the deployer. There is one caveat though - the updated app might have simply behaved in a way unexpected by older version instances and - for example - generated different summaries or "upgraded" kvstore contents.

So it might not be that easy.

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...