Splunk Search

excludeFromUpdate for app doesn't override class level setting

sylim_splunk
Splunk Employee
Splunk Employee

The app level serverclass setting "excludeFromUpdate" does not override high-level settings. Splunk serverclass.conf documentation indicate it should override higher-level settings.

Below is an example of a serverclass called myServerClass. I do not want to exclude anything from the app level, especially for myApp, thus, having an empty value.
The excludeFromUpdate for "yourApp" works fine, overrides the class level configuration.

[serverClass:myServerClass]
excludeFromUpdate = $app_root$/local,$app_root$/default,$app_root$/lookups

[serverClass:myServerClass:app:yourApp]
excludeFromUpdate = $app_root$/lookups

[serverClass:myServerClass:app:myApp]
excludeFromUpdate =

Tags (1)
0 Karma
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

According to the documentation below, it doesn't appear to accept "empty" string for the value and has to be prefixed by "$app_root$".

https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Serverclassconf

*excludeFromUpdate = [,]...

  • Specifies paths to one or more top-level files or directories (and their contents) to exclude from being touched during app update. Note that each comma-separated entry MUST be prefixed by "$app_root$/" to avoid warning messages. * Can be overridden at the serverClass level. * Can be overridden at the app level. * Requires version 6.2.x or higher for both the deployment server and client.*

Instead, you can work it around by adding non-existing directory, such as "$app_root$/dummy .

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

According to the documentation below, it doesn't appear to accept "empty" string for the value and has to be prefixed by "$app_root$".

https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Serverclassconf

*excludeFromUpdate = [,]...

  • Specifies paths to one or more top-level files or directories (and their contents) to exclude from being touched during app update. Note that each comma-separated entry MUST be prefixed by "$app_root$/" to avoid warning messages. * Can be overridden at the serverClass level. * Can be overridden at the app level. * Requires version 6.2.x or higher for both the deployment server and client.*

Instead, you can work it around by adding non-existing directory, such as "$app_root$/dummy .

Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...