App management issues

Before deciding whether to use agent management to manage apps, there are some issues to consider.

The decision to manage an app with agent management is irreversible

CAUTION: Once you start using agent management to manage an app, you cannot later stop using agent management to manage the app. It is important to understand the implications of this.

If you remove an app from the agent management repositoryLocation (defined in serverclass.conf), the agent will delete its copy of the app. There is no way to tell the agent instead to start managing the app on its own.

For example, say you are using agent management to manage updates to "appA". To do this, you have created a directory called "appA" on agent management and you have placed the app's contents there. From now on, whenever the agents poll agent management to check for updates, they compare their checksum for appA with the server checksum for appA. If the checksums differ, the agents download the latest version of the app from the server. However, if appA has been deleted from the agent management app repository, the agent behavior is to delete their own instances of the app.

Therefore, by deleting an app from agent management, you are not telling the agents to stop using agent management to manage the app and to start managing it on their own. Instead, you're actually telling them to delete the app. Once agent management manages an app, it always manages that app.

The only way to allow an instance to continue managing its own copy of such an app is to disable the instance's agent functionality. If an instance is no longer an agent of agent management, agent management will no longer manage its apps.

CAUTION: Because of this behavior, you should be extremely cautious before deciding to use agent management to manage the Splunk Enterprise search app. Managing the search app through agent management prevents users from saving any unique searches on their search heads. And because there's no way to tell agent management to stop managing an app, you're stuck with that decision.

Apps with lookup tables

In some cases, your indexers or search heads might be running apps that save information in lookup tables. Be careful about using agent management to manage such apps. When agent management distributes an updated app configuration, it overwrites the existing app. At that point, you'll lose those lookup tables.

You can work around this issue with the excludeFromUpdate setting in serverclass.conf. See Protect content during app updates.