Getting Data In

Why is Splunk marking a custom TA as deprecated

DMohn
Motivator

Hi Splunkers

We have built a custom technical add-on for our BlueCoat Appliances. Now Splunk is marking this TA as deprecated (Message: "Deprecated app TA-bluecoat is installed in the enabled state. Please uninstall this app using methods appropriate for your installation")

How can it be that Splunk marks a custom add-on as deprecated?

The app.conf setting check_for_updates is set to false - so there should be no check here.

Can we solve this somehow, as the message is quite nagging, and we are needing the TA?

Thanks for your advice.

0 Karma
1 Solution

DMohn
Motivator

I can give the answer myself here - after some thorough investigation...

The reason was our installation of the Splunk Enterprise Security Suite. During installation the TA was marked as deprecated, as it should have been replaced by a new one.

We have removed the app out of the ESS list of deprecated apps, and everything works fine!

View solution in original post

kmanson
Path Finder

During installation the TA was marked as deprecated, as it should have been replaced by a new one. In my case I am specifically using an app that has the same name as a depreciated app.

To turn off the nagging alert I removed the app from this file.
/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/install/deprecated_apps.txt

DMohn
Motivator

I can give the answer myself here - after some thorough investigation...

The reason was our installation of the Splunk Enterprise Security Suite. During installation the TA was marked as deprecated, as it should have been replaced by a new one.

We have removed the app out of the ESS list of deprecated apps, and everything works fine!

andrew_bostic1
New Member

I guess a better question is how do you fix this? what needs to be updated to stop this error message?

0 Karma

andrew_bostic1
New Member

Where do you find the ESS list of deprecated apps?

0 Karma

DMohn
Motivator

I found this in the ESS installation log under $SPLUNK_HOME$/var/log/splunk

0 Karma

mreynov_splunk
Splunk Employee
Splunk Employee

Not sure why the message, but perhaps you can use this TA instead: https://splunkbase.splunk.com/app/2758/

0 Karma

jkat54
SplunkTrust
SplunkTrust

I would assume it's been deprecated as per the Advanced XML deprecation (release 6.3+). Unfortunately I can only comment as I dont know how to disable the message as you desire.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...