I want to disable a Splunk app using curl command and then enable it back. Is there a way to do it without restarting Splunk?
I couldn't find anything in the REST reference manual for Apps - http://docs.splunk.com/Documentation/Splunk/6.5.1/RESTREF/RESTapps
That's not documented there because it's documented more generally here: http://docs.splunk.com/Documentation/Splunk/6.5.1/RESTUM/RESTusing#Enable_and_disable_endpoint
Same principle applies for all disable-able objects.
That's not documented there because it's documented more generally here: http://docs.splunk.com/Documentation/Splunk/6.5.1/RESTUM/RESTusing#Enable_and_disable_endpoint
Same principle applies for all disable-able objects.
In an SHC you should distribute this via the SHC deployer.
The endpoint works for disabling an app on the search head where I issue the CURL command, but the changes don't get replicated to any of the other peers in the SHC.
Is there some way I can disable it across all peers?
Do I need to issue the curl command on all peers?
You can disable REST for the entire node but I don't think you can selectively.