Targeted app installation on Victoria Experience

Targeted app installation on Victoria Experience lets you install apps on specific search heads and search head clusters, giving you precise control over app visibility, RBAC, and resource utilization.

Splunk Cloud Platform supports targeted app installation on Victoria Experience. Use targeted app installation to install apps on specific search heads and search head clusters, instead of deploying apps to all search heads by default.

Targeted app installation restores the app management experience available in Classic Experience and Splunk Enterprise, giving you precise control over app visibility, RBAC, and resource utilization across your deployment.

Requirements

Targeted app installation on Victoria Experience requires:

  • Splunk Cloud Platform Victoria Experience version 10.2.2510 or higher.
  • The sc_admin role in Splunk Cloud Platform.

How targeted app installation works

To use targeted app installation, you specify a target search head or search head cluster when installing an app. The app installs only on that target, rather than on all search heads in your deployment.

Targeted app installation is enabled by default for all self-service app installation methods in Splunk Cloud Platform Victoria Experience, including Splunk Web, Admin Config Service (ACS) CLI, and ACS API.

Terraform Provider for Splunk Cloud Platform also supports targeted app installation.

Use targeted app installation in Splunk Web

When you install apps in Splunk Web, the app installs on the search head or search head cluster you are currently logged in to.

To install an app using the app browser in Splunk Web, open the Manage Apps page, select an app, and then select Install.

For more information on installing apps in Splunk Web, see Install apps on your Splunk Cloud Platform deployment.

Use targeted app installation with the ACS API

To install an app using targeted app installation with the ACS API, you must add the prefix of the target search head or search head cluster to the stack URL when sending an API endpoint request to install the app. You must also add the scope=local query parameter in the request URL.

For example, to install a private app on a search head cluster with search head prefix "shc1" and stack URL "csms-2io6tw-47150", send an HTTP POST request to the apps/victoria endpoint:

CODE 
curl -X POST 'https://admin.splunk.com/shc1.csms-2io6tw-47150/adminconfig/v2/apps/victoria?scope=local'
--header 'X-Splunk-Authorization: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9…' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…' \
--header 'ACS-Legal-Ack: Y' \
--data-binary '@/Users/cjones/Downloads/testapp.tar.gz'

For more information on using targeted app installation with the ACS API, see Target a specific search head for ACS operations.

For more information on using the ACS API to install private apps on Victoria Experience, see Manage apps in Splunk Cloud Platform.

Use targeted app installation with the ACS CLI

ACS CLI version 2.20 and higher supports targeted app installation.

To install an app using targeted app installation with the ACS CLI, you must set the target search head for the current stack. The specified search head persists as the target search head for subsequent ACS CLI operations. You must also specify the --scope parameter as "local".

For example, to install a Splunkbase app on "shc1":

  1. Set the target search head to "shc1":
    CODE 
    acs config use-stack stack_name --target-sh shc1
  2. Install the app using the acs apps install splunkbase command, specifying the Splunkbase app ID and the --scope value as "local":
    CODE 
    acs apps install splunkbase --splunkbase-id 5667 --scope local
    Note: If you do not include the --scope local parameter with the installation command, the app installs on all search heads. This behavior preserves the backward compatibility with Victoria Experience deployments prior to version 10.1.2507.

For more information, see Administer Splunk Cloud Platform using the ACS CLI.