Refine your search:

Using Splunk server & clients running 4.1.2. When I installed Splunk on our many clients I enabled the SplunkLightForwarder app. All other configurations are made via the deployment server client model. Now I need to disable SplunkLightForwarder so I can deploy a customized version of the SplunkLightForwarder. Rather than touching all of our Splunk clients, is there a way to deploy an app that can disable the SplunkLightForwarder.

asked 17 May '10, 23:26

mkinner's gravatar image

mkinner
312
accept rate: 0%


2 Answers:

I would not recommend attempting to disable an app via another app, or try to force apps to contend with their configurations.

There are multiple ways to enable/disable an app. Manually, you would edit the app.conf file within the specific app and set the state parameter to be enabled (or disabled). If you are using the deployment server, it would make sense to just modify the app.conf for the SplunkLightForwarder to use a disabled setting in the local directory.

link

answered 18 May '10, 00:12

Simeon's gravatar image

Simeon ♦
3.5k4419
accept rate: 25%

edited 18 May '10, 06:19

gkanapathy's gravatar image

gkanapathy ♦
24.1k1620

Thank you Simeon!

(18 May '10, 15:44) mkinner

You may want to consider creating your own empty SplunkLightForwarder app, and then deploying that app to your clients. This is pretty similar to what Simeon was pointing out, except I would suggest just making a "blank" app (which I think is slightly more obvious what's going on. You could even put a simple little "README" file in there that notes that you have intentionally wiped out this app) rather than starting with a real copy of SplunkLightForwarder.

This topic is covered well in the Apps: Disable or Delete? post.

link

answered 18 May '10, 13:11

Lowell's gravatar image

Lowell ♦
9.1k623
accept rate: 40%

Thank you Lowell!

(18 May '10, 15:45) mkinner
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×202
×176

Asked: 17 May '10, 23:26

Seen: 702 times

Last updated: 18 May '10, 13:11

Copyright © 2005-2012 Splunk, Inc. All rights reserved.