All Apps and Add-ons

Apps Coming Back after Removed

vnguyen46
Contributor

Hello - There are two Proofpoint app/TA and one custom app associated. I removed them all from CLI, but they keep coming back right after removed. There could be some setup that causes the issue. Anyone has any ideas? Thanks,

Tags (1)
0 Karma

woodcock
Esteemed Legend

Almost certainly you are connected to a Deployment Server whose job it is to ensure that your node has the apps that it should. It could also be part of a cluster. Search Head Clusters use a Deployer and Indexers use a Cluster Master to do similar things, but my bet is on DS.

0 Karma

vnguyen46
Contributor

That's correct. DS pushed the app down to SH and I was able to remove it from the root. The follow up question, what is pro and con to have apps in DS and directly install on the SH? thanks,

0 Karma

woodcock
Esteemed Legend

You pretty much already know the answer to this and it is a separate question, better suited to be asked as a separate question (answers is not a social media site where threads wander). I would click Accept on the best answer here that helped you (and UpVote any other good ones) and post a new question.

chrisyounger
SplunkTrust
SplunkTrust

HI @vnguyen46

There are a few reasons this could be occurring:

  • A deployment server is pushing the app to you. (most likely)
  • A search head cluster deployer is pushing the app to you.

Cluster masters also can push apps to a server, however they would end up in /slave-apps/ so I will assume this is not the case for you.

You need to remove the app from the upstream server.

All the best

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...