Deployment Architecture

Getting error: "Splunk_TA_winows already installed via search head cluster deployer, UI, CLI, or REST API; it may not be overridden via deployment server"

Communicator

Historically have successfully deployed the SplunkTAwindows app to 3000+ devices. Recently discovered in a recent update that a minor typo in inputs.conf caused the System logs to no longer be collected. Corrected that typo, and re-deployed the app via our deployment server. VAST majority of those 3000+ devices successfully completed the new download/install.

~300 devices are showing deployment errors and when I look into the interal logs I'm finding:
"WARN DeployedApplication - app=SplunkTAwindows was already installed via search head cluster deployer, UI, CLI, or REST API; it may not be overridden via deployment server; remove existing app=SplunkTAwindows via search head cluster deployer, UI, CLI, or REST API if you wish to install it via deployment server"

Which makes no sense because our deployment server and our search head cluster deployer (SHCD) are two separate devices and the SHCD doesn't see anything other than our search nodes, it also doesn't have anything present in the deployment-apps directory, and it's never been used to deploy to anything but the cluster nodes via the shcluster/apps directory
How can I remove something that doesn't exist?

Overall, needing to know how to correct this issue so the clients will correctly update from the new app present on the deployment server?

0 Karma
Highlighted

Re: Getting error: "Splunk_TA_winows already installed via search head cluster deployer, UI, CLI, or REST API; it may not be overridden via deployment server"

Esteemed Legend

I would create a new serverclass for those host values and create a custom app with a script in the payload that deletes the SplunkTAWindows app. I would start with this app and modify it accordingly:

https://splunkbase.splunk.com/app/2722/

0 Karma