I have a custom Splunk add-on that was developed and tested on Splunk Enterprise 10.1. It was functioning correctly and visible in the Apps list. After upgrading Splunk to version 10.2, the add-on is no longer visible in the UI. The installation completes without errors, but the app does not appear under Apps. I would like clarification on the following: Are there any changes introduced in Splunk 10.2 that could cause an add-on to be hidden after upgrade? Can settings like max_version in app.conf prevent the add-on from loading in newer versions? Does Splunk 10.2 enforce new AppInspect or validation checks that could automatically disable an app? What logs should I check to identify why the add-on is not appearing? What is the recommended best practice to ensure an add-on remains compatible across future Splunk Enterprise upgrades? The add-on uses standard configuration files and modular inputs (no unsupported APIs). Any guidance on maintaining compatibility across minor Splunk upgrades would be appreciated. ... View more

  I  have a question about moving an HTTP Event Collector (HEC) integration from a Splunk demo setup to a production setup. Right now, I am using a demo Splunk environment where HEC is enabled on port 8088. My application sends events to a URL similar to: https://demo-host:8088/services/collector For the production Splunk environment, I was told that no separate port (like 8088) is required because HEC will be exposed through HTTPS, possibly behind a load balancer or proxy. My questions are: When switching from the demo environment to the production environment, does the Splunk instance URL typically change? If the URL changes, what impact does this have on the existing integration? Do I only need to update the hostname and port? Will the HEC token also change? Any SSL or network/firewall considerations? Is there anything specific to keep in mind when migrating a HEC integration from demo to production? Background: Demo setup uses HEC on port 8088 Production setup will expose HEC without a custom port (likely on HTTPS 443) I want to understand how this difference affects the application endpoint configuration ... View more

I need a python file/ function to be triggered while deleting a input/ configuration ... View more

Error thrown: Internal configuration file error. Something wrong within the package or installation step. Contact your administrator for support. Detail: Error: duplicate l keys is not allowed at appendError. I'm trying to create a new app in Splunk add-on builder. This error is thrown whenever I load the app's inputs or configuration page ... View more