All Apps and Add-ons

How to prevent a custom app from being deleted in SHC nodes?

Splunk Employee
Splunk Employee

I am trying to deploy a searchhead app into etc/apps of each searchhead in a SHC, but without using deployer. The app content (inputs.conf) is slightly different on each SH (contains hostname) and thus cannot be pushed by deployer.

So, I am copying the host specific app onto each SH and restart the SHC. Below are the logs that I discovered when I do that:

11-21-2017 00:03:14.844 +0000 INFO ApplicationManager - Detected app creation: my_cool_app
11-21-2017 00:18:25.118 +0000 WARN ApplicationManager - Cannot import non-existent application: my_cool_app

After that, my custom app gets deleted from every SH.

So, the question is, what else do I need to do so that Splunk does not delete my app? It is my understanding, that it is still supported to deploy apps directly into etc/apps on a SHC member. And many OOB apps (alert_logevent, framework, search, gettingstarted, launcher, etc.) are deployed in that fashion and are not coming through the deployer.

Tags (1)
0 Karma

Revered Legend

You absolutely need deployer to deploy an app to SHC. You can't deploy the app directly on the SH. Since, you need different version (in terms of the configs) to be deployed to different members, you can try this workaround.

1) In the apps that you want to push to SHC members, move/merge all configuration from <app_name>/default into <app_name>/localdirectory.
2) On the deployer, create an app with same name <app_name> with just default directory. Inside default directory, just place the app.conf from original app (from app title)
3)Deploy the apps from deployer, with just default directory to SHC members.
4) Manually copy the app you created in step 1 (without default directory) to all SHC members in etc/apps.
5) Rolling restart SHC.

New Member

@somesoni2 i am facing the same issue here,i do not have the deployer instance ,so what is the other way to create app in SH without deployer?
also why the app gets deleted when we create it directly on search head?
any help would be great!

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...