Deployment Architecture

Deployment server - deleting apps- determine on client which apps have EVER been managed

Path Finder

How can i determine if an app has ever been managed or is being managed?

I added a deploymentclient.conf to a dev HWF server and created serverclass etc on DS with only one test app. The deployment server only had one test app to push out and i assumed none of the other apps have ever been managed. They have definitely not been managed by this DS.

Anyhow, the Deployment server deleted about 20 apps....!!!!

I presume they were managed for a short time by someone else doing some testing, a long time ago?!

How can i found out if the apps have a history of being managed!? is there a log file or conf file somewhere? there must be!



0 Karma


on a client, you may be able to find copies of previously managed instances of apps in ./var/run folder.

depending on how quickly your logs rotate, you should also be able to review ./var/log/splunk/splunkd.log on both deployment-client and deployment-server logs for evidence of changes in deployed apps over time. on the splunk deployment server, you should also be able to look at internal access logs for who made changes over time.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...