Deployment Architecture

Applying search head cluster bundle not removing old directories feature or bug?

Path Finder

Dear all,

I am experiencing follwoing issue with Splunk 6.3.0 on linux machines:
Before setting up a search head cluster we have had a script contained in our app within the "bin" folder to synchronise our lookup tables.
After setting up the cluster this functionality is no longer required.
I therefore removed the bin folder completely from our app and redistributed the app to our deployer.
Then I applied the shcluster bundle via command to the sh. Now I see that on all search heads the old bin folder is still there...
On the deployer I was able to verify that the folder no longer is there.

I tought that maybe the command /opt/splunk/splunk/bin/splunk apply shcluster-bundle --answer-yes -target : -preserve-lookups true -auth : would also preserve old folder so I removed the parameter -preserve-lookups untortunately this didn't help either.
Next I re-created the bin folder and only placing a README file there. Hopeing that this would overwritte the existing and no longer needed script on the search heads...
I can still find the script on the search head instances.

Is this a wanted feature or is this possibly an error in the distribution mechanism? Did someone experience the same?

The only workaround I can think of now is to place a script within the apps for the sh instances to clean-up on the instance direclty and restarting those...

Any other ideas or hints are greatly appreciated.


It will only remove apps completely.
1) You could remove the complete app from de the deployer
2) push the budles (now the app should be gone on the SH's) .
3) restore the app on the deployer (without the bin directory
4) push bundles.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...