Splunk Enterprise

Difference between different options for app update

dschwarz
Engager

Hello Splunkees,

 

what are the differences between the different options for app updates? I know 3 diffentent ways to update an app:

 

1) Via webinterface: Apps -> Manage Apps -> Install app from file -> Check 'Upgrade app. Checking this will overwrite the app if it already exists.'

2) Via CLI: 

./splunk install app <app_package_filename> -update 1 -auth <username>:<password>

3) Extract the content of the app.tgz to $SPLUNK_HOME/etc/apps/ (if app already exists, override files) and after that restart splunk service.

 

Background of my question: I want to implement an automated app update process with ansible for our environment and I want to use the smartest method. Currently, we're using Splunk 9.1.5.

 

Thank you!

 

BR

dschwarz

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The biggest difference is #3 requires a restart of Splunk before the app can be used.  For the other methods, a restart may be needed (depending on what is changed), but may not be required.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Adding to what @richgalloway already said - remember than some options might simply be not available in specific situations. Many Splunk components will actually run without web interface enabled so in those cases you will obviously not be able to use it for upgrade. If your environment grows and you step into the clustering grounds the only way of installing apps (including upgrading) will be using clustering mechanisms (either pushing from deployer or cluster manager). Even with small-scale installation you can use deployment server to serve apps to your Splunk components. And that's actually a typical Splunk way of automating app install/upgrade.

richgalloway
SplunkTrust
SplunkTrust

The biggest difference is #3 requires a restart of Splunk before the app can be used.  For the other methods, a restart may be needed (depending on what is changed), but may not be required.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...