Deployment Architecture

App 'search' was installed or modified, and the following objects required a restart: default

the_wolverine
Champion

Frequently my search head displays a banner indicating the the search app was installed or modified and that a restart is required. There seems to be no reason for this to occur, and in our production environment, requires us to open a ticket to get the SH restarted.

0 Karma
1 Solution

the_wolverine
Champion

We've had no explanation or solution provided by Splunk for this issue despite ticket having been opened with support.

What I've done is to create an internal alert which notifies us when the condition occurs. Then we schedule a restart of that SH for the next convenient time.

View solution in original post

0 Karma

the_wolverine
Champion

We've had no explanation or solution provided by Splunk for this issue despite ticket having been opened with support.

What I've done is to create an internal alert which notifies us when the condition occurs. Then we schedule a restart of that SH for the next convenient time.

0 Karma

shawn_smith
New Member

I am experiencing this same issue but the message is regarding my "splunk app for Nix" Did you ever find an answer on this?

0 Karma

premg
Engager

We are also facing same issue in our Search heads.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...