- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Why is Splunk marking a custom TA as deprecate...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Splunkers
We have built a custom technical add-on for our BlueCoat Appliances. Now Splunk is marking this TA as deprecated (Message: "Deprecated app TA-bluecoat is installed in the enabled state. Please uninstall this app using methods appropriate for your installation")
How can it be that Splunk marks a custom add-on as deprecated?
The app.conf setting check_for_updates is set to false - so there should be no check here.
Can we solve this somehow, as the message is quite nagging, and we are needing the TA?
Thanks for your advice.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I can give the answer myself here - after some thorough investigation...
The reason was our installation of the Splunk Enterprise Security Suite. During installation the TA was marked as deprecated, as it should have been replaced by a new one.
We have removed the app out of the ESS list of deprecated apps, and everything works fine!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
During installation the TA was marked as deprecated, as it should have been replaced by a new one. In my case I am specifically using an app that has the same name as a depreciated app.
To turn off the nagging alert I removed the app from this file.
/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/install/deprecated_apps.txt
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I can give the answer myself here - after some thorough investigation...
The reason was our installation of the Splunk Enterprise Security Suite. During installation the TA was marked as deprecated, as it should have been replaced by a new one.
We have removed the app out of the ESS list of deprecated apps, and everything works fine!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I guess a better question is how do you fix this? what needs to be updated to stop this error message?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Where do you find the ESS list of deprecated apps?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I found this in the ESS installation log under $SPLUNK_HOME$/var/log/splunk
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not sure why the message, but perhaps you can use this TA instead: https://splunkbase.splunk.com/app/2758/
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would assume it's been deprecated as per the Advanced XML deprecation (release 6.3+). Unfortunately I can only comment as I dont know how to disable the message as you desire.
Detecting Remote Code Executions With the Splunk Threat Research Team
Observability | Use Synthetic Monitoring for Website Metadata Verification
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
