Install or Upgrade Splunk IT Essentials Learn

Follow these steps to install Splunk IT Essentials Learn (ITE Learn). This version of ITE Learn is available on Splunk Cloud Platform and Splunk Enterprise on-premises. Because the app includes demo data, it takes about 17 MB of storage on the search head.

Splunk IT Essentials Learn version 1.1.8 supports Splunk platform version 9.2. It is not designed to support earlier Splunk platform versions.

Single-instance deployment

Follow these steps to install or upgrade ITE Learn in a single-instance deployment.

1. Download the latest ITE Learn app from Splunkbase.
2. From the Splunk Web home screen, click the gear icon next to Apps.
3. Select Install app from file.
4. Select Choose File.
5. Select the ITE Learn file you downloaded from Splunkbase.
6. If you are upgrading, select Upgrade app. Checking this will overwrite the app if it already exists.
7. Verify that the app appears in the list of apps and add-ons. You can also find it on the server at $SPLUNK_HOME/etc/apps/<Name_of_add-on>.

Distributed deployment

Install Splunk IT Essentials Learn on search heads only. This app has no impact on indexers.

Because IT Essentials Learn has no impact on indexers, Splunk uses the following code to avoid replicating large files such as lookups, bin, metadata, and default in the distsearch.conf file while allowing only the README.txt file to include it_essentials_learn app as part of the knowledge bundle:

[replicationAllowlist]
itess_learn_allow = apps/it_essentials_learn/README.txt

[replicationDenylist]
# IT Essentials learn.

itess_learn_lookup = apps/it_essentials_learn/lookups/...
itess_learn_bin = apps/it_essentials_learn/bin/...
itess_learn_metadata = apps/it_essentials_learn/metadata/...
itess_learn_default = apps/it_essentials_learn/default/...

For installation instructions, see Install an add-on in a distributed Splunk Enterprise deployment.

Alongside IT Service Intelligence

This app doesn't interfere with ITSI, and can be safely installed on an ITSI search head or search head cluster.