I am experiencing follwoing issue with Splunk 6.3.0 on linux machines:
Before setting up a search head cluster we have had a script contained in our app within the "bin" folder to synchronise our lookup tables.
After setting up the cluster this functionality is no longer required.
I therefore removed the bin folder completely from our app and redistributed the app to our deployer.
Then I applied the shcluster bundle via command to the sh. Now I see that on all search heads the old bin folder is still there...
On the deployer I was able to verify that the folder no longer is there.
I tought that maybe the command /opt/splunk/splunk/bin/splunk apply shcluster-bundle --answer-yes -target : -preserve-lookups true -auth : would also preserve old folder so I removed the parameter -preserve-lookups untortunately this didn't help either.
Next I re-created the bin folder and only placing a README file there. Hopeing that this would overwritte the existing and no longer needed script on the search heads...
I can still find the script on the search head instances.
Is this a wanted feature or is this possibly an error in the distribution mechanism? Did someone experience the same?
The only workaround I can think of now is to place a script within the apps for the sh instances to clean-up on the instance direclty and restarting those...
It will only remove apps completely.
1) You could remove the complete app from de the deployer
2) push the budles (now the app should be gone on the SH's) .
3) restore the app on the deployer (without the bin directory
4) push bundles.