Installation

Splunk upgraded to 7.0.0 from Linux but message still shows new version available?

wuming79
Path Finder

Hi,

I have upgraded my Splunk to 7.0.0 from Linux terminal. Terminal shows version is not 7.0.0. Web interface->about also reflected 7.0.0 but there are still messages showing a new version and new maintenance versions are available. Is this a bug?

Labels (2)
0 Karma
1 Solution

inventsekar
Ultra Champion

from a similar post, web.conf contains the setting from which you can disable Splunk automatic checking for new versions:

By default the setting is:

updateCheckerBaseURL = http://quickdraw.splunk.com/js/

To disable automatic checking, add to your
$SPLUNK_HOME/etc/system/local/web.conf:

[settings]
updateCheckerBaseURL = 0

Note: Disabling this feature will apply to all Splunk non-admin and admin users.

For further information refer to:

http://www.splunk.com/base/Documentation/4.0.11/Admin/Webconf

or a related topic on suppressing messages for non-admin users.

For the free version of Splunk the webconf is located here.
$SPLUNK_HOME/etc/system/default/web.conf

The setting below is the same.
`[settings]

modify this

updateCheckerBaseURL = http://quickdraw.splunk.com/js/

to

updateCheckerBaseURL = 0`

View solution in original post

0 Karma

wuming79
Path Finder

Hi, somehow when I log in now, the message is gone. I haven't start to work on the web.conf. I guess it takes some time for web interface to update the messages...

0 Karma

inventsekar
Ultra Champion

oh that is great.. maybe, just for learning, you can use the find command list on the below comment and check that web.conf file.. if in future needed, you can edit it. maybe, you can accept the below answer as well 😉

0 Karma

inventsekar
Ultra Champion

from a similar post, web.conf contains the setting from which you can disable Splunk automatic checking for new versions:

By default the setting is:

updateCheckerBaseURL = http://quickdraw.splunk.com/js/

To disable automatic checking, add to your
$SPLUNK_HOME/etc/system/local/web.conf:

[settings]
updateCheckerBaseURL = 0

Note: Disabling this feature will apply to all Splunk non-admin and admin users.

For further information refer to:

http://www.splunk.com/base/Documentation/4.0.11/Admin/Webconf

or a related topic on suppressing messages for non-admin users.

For the free version of Splunk the webconf is located here.
$SPLUNK_HOME/etc/system/default/web.conf

The setting below is the same.
`[settings]

modify this

updateCheckerBaseURL = http://quickdraw.splunk.com/js/

to

updateCheckerBaseURL = 0`

0 Karma

wuming79
Path Finder

my /opt/splunk/etc/system/default has web.conf and updateCheckerBaseURL = http://quickdraw.splunk.com/js/, but I guess I don't need to change anything now. Thanks.

0 Karma

wuming79
Path Finder

Hi inventsekar,

Thanks for the terminal tips.

I found 3 web.conf under opt/splunk:

  1. opt/splunk/etc/apps/SplunkLightForwarder/default/web.conf
  2. opt/splunk/etc/apps/Splunk_instrumentation/default/web.conf
  3. opt/splunk/etc/system/default/web.conf

Which one is the one that I should change in future? Do I copy the default, create a local folder under $SPLUNK_HOME/etc/system/local/web.conf or I can wok directly with the one in $SPLUNK_HOME/etc/system/default/web.conf?

what does opt and $SPLUNK_HOME has to do with each other?

0 Karma

rpquinlan
Path Finder

To answer your last question first:

" what does opt and $SPLUNK_HOME has to do with each other?

--$SPLUNK_HOME is used in documentation because that's a variable part of your install. You could have installed Splunk where you did (/opt/splunk), or you could have installed it elsewhere (like /opt/apps/splunk), so to keep things consistent, $SPLUNK_HOME is used to represent the directory path to where your installation of splunk is - in your case, /opt/splunk

--It's a best practice to never change any of the files in the "default" directory (whether that's system/default, apps/xxx/default, or anything like that), as they can be overwritten with every upgrade.

In your case, you're on the right track - copy your /opt/splunk/etc/system/default/web.conf (or as it's said, $SPLUNK_HOME/etc/system/default/web.conf) file to $SPLUNK_HOME/etc/system/local. Then, delete everything you're NOT changing, leaving only the modified "updateCheckerBaseURL" field.

Although you're not experiencing the problem anymore, the above about not modifying files in the "default" directory is quite important to pay attention to, so I wanted to add that..

0 Karma

wuming79
Path Finder

my /opt/splunk/etc/system/local did not have the web.conf file. I could not check my settings there.

0 Karma

inventsekar
Ultra Champion

maybe, just search for web.conf
find /opt/splunk/etc/ -name "web.conf"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...