App 'search' was installed or modified, and the following objects required a restart: default

[the_wolverine]

Frequently my search head displays a banner indicating the the search app was installed or modified and that a restart is required. There seems to be no reason for this to occur, and in our production environment, requires us to open a ticket to get the SH restarted.

[the_wolverine · Accepted solution]

We've had no explanation or solution provided by Splunk for this issue despite ticket having been opened with support.

What I've done is to create an internal alert which notifies us when the condition occurs. Then we schedule a restart of that SH for the next convenient time.

[shawn_smith]

I am experiencing this same issue but the message is regarding my "splunk app for Nix" Did you ever find an answer on this?

[premg]

We are also facing same issue in our Search heads.