Splunk® Enterprise

Updating Splunk Enterprise Instances

Acrobat logo Download manual as PDF

Splunk Enterprise version 7.1 is no longer supported as of October 31, 2020. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
Acrobat logo Download topic as PDF

Use forwarder management to manage apps

The main function of forwarder management is to create server classes that map deployment apps to clients. This process is described in the topic "Use forwarder management to define server classes".

The interface also provides tools to manage deployment apps. You can:

  • Edit an app
  • Uninstall an app
  • View app deployment status

Edit an app

To edit an app:

1. Go to the Apps tab, where you'll see a list of all apps.

2. Find the app you want to edit and click its Edit action.

3. Select the Edit option. This takes you to the Edit App screen for that app.

There are a few things you can do from here:

  • Add the app to a new server class or delete it from an existing server class. On the upper part of the screen, there's a section called Server Classes. Click the + button to add the app to a new server class. Click the x to the right of a server class to remove the app from a server class.
  • Specify the behavior that occurs immediately after a deployment client downloads the app. There are two options:
    • Enable App. This enables the app on the client.
    • Restart Splunkd. This restarts splunkd on the client.

When you have finished with your changes, click the Save button. This will cause the deployment server to save the changes and redeploy the app (as well as any other apps that have been updated in the interim). For details on how app deployment occurs, see "Deploy apps to clients".

Important: You cannot edit the actual content of the app from the forwarder management interface. To change its content, you must update the app through the deployment server's file system, as described in "Create deployment apps".

Uninstall an app

You can uninstall an app from all server classes or from just a single server class.

Uninstall from all server classes

To uninstall an app from all server classes:

1. Go to the Apps tab, where you'll see a list of all apps.

2. Find the app you want to edit and click its Edit action.

3. Select the Uninstall option.

This action removes the app from all server classes and uninstalls it from all clients. It does not actually remove the app from the deployment server's file system.

Uninstall from one server class

To uninstall an app from just one server class:

1. Go to the Server Classes tab, where you'll see a list of all server classes.

2. Find the server class from which you want to remove the app, and click its Edit action.

3. Select the Edit Apps option. This takes you to the Edit Apps page. On the Edit Apps page, there are two columns: Unselected Apps and Selected Apps, with a list of apps under each.

4. Locate the app that you want to uninstall in the Selected Apps column.

5. Click the app name to move it from the Selected Apps column to the Unselected Apps column.

6. Click Save.

The deployment server removes the app from all clients in that server class.

View app deployment status

To view the deployment status of an app:

1. Go to the Apps tab, where you'll see a list of all apps.

2. Locate the Clients column. The column indicates how many clients have received the app.

For more information, click on the app name. This takes you to a screen that shows a summary of information about the app, as well as the app's clients and their deployment status. You can click on the arrow to the left of each client column to see the apps and server classes that the client is associated with.

Last modified on 11 September, 2013
Estimate deployment server performance
Use forwarder management to manage clients

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters