All Apps and Add-ons

Built-in apps are missing from shcluster directory on search head deployer, will they be removed from search head upon deployment?

alcarlsson
Engager

I want to deploy app configurations from a deployer to my search heads using the command

splunk apply shcluster-bundle

There are several apps in the shcluster directory, all which already exist on the search heads. All built-in stock apps (such as search) are however missing from shcluster.

Question: Will these stock apps be removed from the search heads if a deployment is performed, if they are missing from shcluster? Or is there a rule that prevents any stock apps from being removed?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Built-in apps must not be included in the shcluster bundle. They will not be deleted by a bundle push.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...