I thought I was following OK practice as these were customisations to collections.conf and transforms.conf and savedsearches.conf in the local directory
But it appears the app owner just got rid of them when I upgraded to 5.0.0 to 5.1.0
Working to recover the situation and have pinged the developer. The data should be recreated
Was it my fault by adding stanzas to a commercial app ? or should I have been protected if I stuck to local copies ?
As before I just clicked on upgrade in the management of apps screen and it seems to have emptied the local directory ! restoring from a backup
I got an all-in one setup, and just download the app without pre-testing - my bad
Ok. But how did you update them? Using the "apps" screen in splunk webui? By downloading them manually and installing them from cli?
I'm fairly sure by clicking on the update hint from the manaagement screen /en-US/manager/launcher/apps/local
If you had your definitions in app/local directory, it should have been retained across upgrades. The app should overwrite the app/default directory (and therefore you should never directly edit files there) but your local files shouldn't be touched.
What is your environment? Do you use all-in-one setup or do you have search-head cluster? How do you deploy apps? How did you upgrade the app?