Deployment Architecture

Getting error: "Splunk_TA_winows already installed via search head cluster deployer, UI, CLI, or REST API; it may not be overridden via deployment server"

kearaspoor
SplunkTrust
SplunkTrust

Historically have successfully deployed the Splunk_TA_windows app to 3000+ devices. Recently discovered in a recent update that a minor typo in inputs.conf caused the System logs to no longer be collected. Corrected that typo, and re-deployed the app via our deployment server. VAST majority of those 3000+ devices successfully completed the new download/install.

~300 devices are showing deployment errors and when I look into the interal logs I'm finding:
"WARN DeployedApplication - app=Splunk_TA_windows was already installed via search head cluster deployer, UI, CLI, or REST API; it may not be overridden via deployment server; remove existing app=Splunk_TA_windows via search head cluster deployer, UI, CLI, or REST API if you wish to install it via deployment server"

Which makes no sense because our deployment server and our search head cluster deployer (SHCD) are two separate devices and the SHCD doesn't see anything other than our search nodes, it also doesn't have anything present in the deployment-apps directory, and it's never been used to deploy to anything but the cluster nodes via the shcluster/apps directory
How can I remove something that doesn't exist?

Overall, needing to know how to correct this issue so the clients will correctly update from the new app present on the deployment server?

0 Karma

woodcock
Esteemed Legend

I would create a new serverclass for those host values and create a custom app with a script in the payload that deletes the Splunk_TA_Windows app. I would start with this app and modify it accordingly:

https://splunkbase.splunk.com/app/2722/

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...