All Apps and Add-ons

Apps Coming Back after Removed

vnguyen46
Contributor

Hello - There are two Proofpoint app/TA and one custom app associated. I removed them all from CLI, but they keep coming back right after removed. There could be some setup that causes the issue. Anyone has any ideas? Thanks,

Tags (1)
0 Karma

woodcock
Esteemed Legend

Almost certainly you are connected to a Deployment Server whose job it is to ensure that your node has the apps that it should. It could also be part of a cluster. Search Head Clusters use a Deployer and Indexers use a Cluster Master to do similar things, but my bet is on DS.

0 Karma

vnguyen46
Contributor

That's correct. DS pushed the app down to SH and I was able to remove it from the root. The follow up question, what is pro and con to have apps in DS and directly install on the SH? thanks,

0 Karma

woodcock
Esteemed Legend

You pretty much already know the answer to this and it is a separate question, better suited to be asked as a separate question (answers is not a social media site where threads wander). I would click Accept on the best answer here that helped you (and UpVote any other good ones) and post a new question.

chrisyounger
SplunkTrust
SplunkTrust

HI @vnguyen46

There are a few reasons this could be occurring:

  • A deployment server is pushing the app to you. (most likely)
  • A search head cluster deployer is pushing the app to you.

Cluster masters also can push apps to a server, however they would end up in /slave-apps/ so I will assume this is not the case for you.

You need to remove the app from the upstream server.

All the best

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...