Splunk Enterprise

Difference between different options for app update

dschwarz
Engager

Hello Splunkees,

 

what are the differences between the different options for app updates? I know 3 diffentent ways to update an app:

 

1) Via webinterface: Apps -> Manage Apps -> Install app from file -> Check 'Upgrade app. Checking this will overwrite the app if it already exists.'

2) Via CLI: 

./splunk install app <app_package_filename> -update 1 -auth <username>:<password>

3) Extract the content of the app.tgz to $SPLUNK_HOME/etc/apps/ (if app already exists, override files) and after that restart splunk service.

 

Background of my question: I want to implement an automated app update process with ansible for our environment and I want to use the smartest method. Currently, we're using Splunk 9.1.5.

 

Thank you!

 

BR

dschwarz

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The biggest difference is #3 requires a restart of Splunk before the app can be used.  For the other methods, a restart may be needed (depending on what is changed), but may not be required.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Adding to what @richgalloway already said - remember than some options might simply be not available in specific situations. Many Splunk components will actually run without web interface enabled so in those cases you will obviously not be able to use it for upgrade. If your environment grows and you step into the clustering grounds the only way of installing apps (including upgrading) will be using clustering mechanisms (either pushing from deployer or cluster manager). Even with small-scale installation you can use deployment server to serve apps to your Splunk components. And that's actually a typical Splunk way of automating app install/upgrade.

richgalloway
SplunkTrust
SplunkTrust

The biggest difference is #3 requires a restart of Splunk before the app can be used.  For the other methods, a restart may be needed (depending on what is changed), but may not be required.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...