How do I make Deployment Server forget about an app it is managing?

[Ellen]

One of my managed apps via Deployment Server is the Search app. Now, due to requirement changes, each Deployment client needs to allow its users to save searches. How do I make it forget about managing the Search, or any other app?

[jbsplunk · Accepted solution]

First keep in mind for any app that you decide to manage via the Deployment Server, the server will maintain information that it is a managed app forever. There is not a way to change that.

So carefully consider managing a key app such as the Search app to whether you really want Deployment Server to manage it in your environment.
It is not recommended unless you always want a consistent and unified Search app across your architecture.

The Search app would not be a good candidate since consider the ability of the client to create saved searches which means a modified savedsearches.conf This will be problematic as the next push from the Deployment Server's version of the Search app will not include those new searches and the client has essential lost its saved searches.

So if you inadvertently added the Search app to eg. $SPLUNK_HOME/etc/deployment-apps and want to "remove" it, you will have to do the following workaround

1) Remove the Search app from your deployment server configuration, and it will disappear from your clients.

2) From the Deployment Server Splunk instance or elsewhere, create a tarball of the Search app and manually unpack it to each client's $SPLUNK_HOME/etc/apps/search directory where the Search app no longer exists.

By doing this, the Deployment Server will no longer be managing the Search app, but you'll have a working copy of Search on the desired instance.

[Ellen]

An enhancement exists for a feature to allow disabling an app that was tagged for deployment server management (ENH-4392)