All Apps and Add-ons

Apps Coming Back after Removed

vnguyen46
Contributor

Hello - There are two Proofpoint app/TA and one custom app associated. I removed them all from CLI, but they keep coming back right after removed. There could be some setup that causes the issue. Anyone has any ideas? Thanks,

Tags (1)
0 Karma

woodcock
Esteemed Legend

Almost certainly you are connected to a Deployment Server whose job it is to ensure that your node has the apps that it should. It could also be part of a cluster. Search Head Clusters use a Deployer and Indexers use a Cluster Master to do similar things, but my bet is on DS.

0 Karma

vnguyen46
Contributor

That's correct. DS pushed the app down to SH and I was able to remove it from the root. The follow up question, what is pro and con to have apps in DS and directly install on the SH? thanks,

0 Karma

woodcock
Esteemed Legend

You pretty much already know the answer to this and it is a separate question, better suited to be asked as a separate question (answers is not a social media site where threads wander). I would click Accept on the best answer here that helped you (and UpVote any other good ones) and post a new question.

chrisyounger
SplunkTrust
SplunkTrust

HI @vnguyen46

There are a few reasons this could be occurring:

  • A deployment server is pushing the app to you. (most likely)
  • A search head cluster deployer is pushing the app to you.

Cluster masters also can push apps to a server, however they would end up in /slave-apps/ so I will assume this is not the case for you.

You need to remove the app from the upstream server.

All the best

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...