When may uninstalling apps or updating configurations on indexers or IDM require a support ticket?

Uninstalling apps or updating configurations on indexers or the Index Data Management (IDM) may require a support ticket, particularly regarding essential apps. Essential apps are critical to the core functionalities of your Splunk deployment, and changes to these can have significant impacts on data ingestion, indexing, and search capabilities. Since these apps are foundational, it is vital to follow procedures that ensure the stability and security of your Splunk environment.

In the context of altering essential apps, support from Splunk can help prevent unintended data loss or service disruption. Therefore, engaging with support for these actions is encouraged to ensure that all precautions are taken and that the updates align with best practices for maintaining system integrity.

The other choices involve scenarios where a support ticket may not be as strictly necessary or may be more subjective to the environment and the significance of the changes being made. For example, while major version updates might seem critical, they often follow a defined upgrade path where such actions can be undertaken with a solid understanding of requirements and potential pitfalls. Similarly, technical issues or security compliance queries can often be addressed without necessitating a support ticket unless they directly pertain to essential applications and their risks.