Deployment Architecture

Can you disable an app with an app?

mkinner
Explorer

Using Splunk server & clients running 4.1.2. When I installed Splunk on our many clients I enabled the SplunkLightForwarder app. All other configurations are made via the deployment server client model. Now I need to disable SplunkLightForwarder so I can deploy a customized version of the SplunkLightForwarder. Rather than touching all of our Splunk clients, is there a way to deploy an app that can disable the SplunkLightForwarder.

Tags (2)

Lowell
Super Champion

You may want to consider creating your own empty SplunkLightForwarder app, and then deploying that app to your clients. This is pretty similar to what Simeon was pointing out, except I would suggest just making a "blank" app (which I think is slightly more obvious what's going on. You could even put a simple little "README" file in there that notes that you have intentionally wiped out this app) rather than starting with a real copy of SplunkLightForwarder.

This topic is covered well in the Apps: Disable or Delete? post.

0 Karma

mkinner
Explorer

Thank you Lowell!

0 Karma

Simeon
Splunk Employee
Splunk Employee

I would not recommend attempting to disable an app via another app, or try to force apps to contend with their configurations.

There are multiple ways to enable/disable an app. Manually, you would edit the app.conf file within the specific app and set the state parameter to be enabled (or disabled). If you are using the deployment server, it would make sense to just modify the app.conf for the SplunkLightForwarder to use a disabled setting in the local directory.

mkinner
Explorer

Thank you Simeon!

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...