Deployment Architecture

Applying search head cluster bundle not removing old directories feature or bug?

MMCC
Path Finder

Dear all,

I am experiencing follwoing issue with Splunk 6.3.0 on linux machines:
Before setting up a search head cluster we have had a script contained in our app within the "bin" folder to synchronise our lookup tables.
After setting up the cluster this functionality is no longer required.
I therefore removed the bin folder completely from our app and redistributed the app to our deployer.
Then I applied the shcluster bundle via command to the sh. Now I see that on all search heads the old bin folder is still there...
On the deployer I was able to verify that the folder no longer is there.

I tought that maybe the command /opt/splunk/splunk/bin/splunk apply shcluster-bundle --answer-yes -target : -preserve-lookups true -auth : would also preserve old folder so I removed the parameter -preserve-lookups untortunately this didn't help either.
Next I re-created the bin folder and only placing a README file there. Hopeing that this would overwritte the existing and no longer needed script on the search heads...
I can still find the script on the search head instances.

Is this a wanted feature or is this possibly an error in the distribution mechanism? Did someone experience the same?

The only workaround I can think of now is to place a script within the apps for the sh instances to clean-up on the instance direclty and restarting those...

Any other ideas or hints are greatly appreciated.

teunlaan
Contributor

It will only remove apps completely.
1) You could remove the complete app from de the deployer
2) push the budles (now the app should be gone on the SH's) .
3) restore the app on the deployer (without the bin directory
4) push bundles.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...