About Senak

Senak · ‎11-09-2022

@VatsalJagani This is the error i am dealing with when trying to push a new app on my SH cluster. Error while creating deployable apps: Error compressing the temporary tarball: /opt/splunk/var/run/splunk/deploy.1805b9b8294a5b90.tmp/apps/SplunkEnterpriseSecuritySuite.bundle: No space left on device It seems like Splunk Enterprise bundle is too big. How can i reduce it size or even prevent splunk to create a bundle for it? Kind regards

Senak · ‎11-09-2022

Ok great, so now , that conf has to be made in etc/shcluster/apps/<my_app>/local/distsearch.conf? Next does that mean the files blacklisted are not going to be in the bundle send to the sh members so not updated but they will not be deleted right? My last question, is it possible to tell splunk to not update a whole app , instead of blacklisting files. My challenge is that i have space issue on the deployer when deploying a new app. Any ideas Thanks

Senak · ‎11-09-2022

Hello @VatsalJagani , Can this work for shcluster when i have my app in etc/shcluster/app ? In other word can i blacklist an app located in etc/shcluster/app/? It has to be done on the deployer right? Thanks

Senak · ‎11-09-2022

thanks @gcusello , Is the following to be changed ? excludeFromUpdate = <path>[,<path>] Can you give me an example of how to exclude "my_app" for instance knowing that i have a symbolic link on /opt/splunk/etc/shcluster/app/my_app Regards

Senak · ‎11-09-2022

Hello splunk team, I'm getting the following error while trying to deploy new app on our SH cluster. Error while creating deployable apps: Error compressing the temporary tarball: /opt/splunk/var/run/splunk/deploy.1805b9b8294a5b90.tmp/apps/SplunkEnterpriseSecuritySuite.bundle: No space left on device While I do understand the error, my challenge is that I can't increase further the /opt/splunk partition. So my question for you guy is if it is possible to exclude SplunkEnterpriseSecuritySuite from the deployement without deleting it. In other words, can I tell splunk to just push a specific app without checking other app like we do it on HF for a specific Server Class? Kind regards,

Senak · ‎07-01-2022

Hi, Your match() syntax in just not good. It should be | eval names= mvfilter(match(names,"32"))

Posts	7
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎06-22-2020

Online Status	Offline
Date Last Visited	‎11-10-2022 12:31 PM

How to exclude an app from being updated on shclus...

Re: How to apply replicationblacklist for a partic...

Re: How to apply replicationblacklist for a partic...

Re: How to apply replicationblacklist for a partic...

Re: How to exclude an app from being updated on sh...

How to exclude an app from being updated on shclus...

Re: how to match string in multi value field