At startup of our indexer beeing part of a cluster there is an error stating that we have 2 *nix-TA installed. One in /etc/apps and one in etc/slave-apps.
As we are using only the clustermaster to deploy apps the first place etc/apps is wrong and not used by our setup.
I deleted this app and after a restart the app is again there.
I did not install splunk with some special command line options.
So why is Splunk installing an app in the wrong possition and where is the configuration?
Hi dyude, @tfechner ,
Can you try removing the app from cluster master and then push the bundle. Then, try deleting the app from etc/apps. Once the app is gone from etc/apps you can again install the app from cluster master.
I hope none of your indexers are connected as deployment client which has Nix app in the corresponding server class. Just mentioned it for the safe side.
mh.. it's not this way:
I never installed the app in /etc/app. I always use the cluster-master.
I remove the wrong app, restart the peer and then the app is again in /etc/apps!
No deployment-client used.
oh - nice to see.
But it is the offical splunk audit linux-TA "TA-linux_audit".
We will search if there is any file which is created by the SHC or similar
Can you try moving the app which basically resides in cluster master to some other directory and then push the bundle(which basically will push the app without TA-nix) and see if the app is still in etc/apps on the slaves.