Deployment Architecture

How do I "un-uninstall" a deployment server app?

woodcock
Esteemed Legend

I was trying to remove an app from a serverclass and I clicked on Uninstall thinking that that would do it (there are 5 different ways to do the same thing on the DS so I have a bad habit of assuming I know what stuff will do).

Not only did it remove the app from my serverclass but it sent the app into some kind of phantom zone banishment from which I am unable to reclaim it. No matter what I do, the DS GUI will no longer recognize this app as an app.

I have deleted it from deployment-apps and re-added it but this did nothing. I have searched the entire $SPLUNK_HOME for any references to this app and can find nothing. What exactly does uninstall do and how do I undo it?

0 Karma
1 Solution

woodcock
Esteemed Legend

OK, I figured it out. I manually added this back into my serverclass.conf file:

[serverClass:SomeAppThatExists:app:YourUninstalledAppNameHere]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled

Then I rebooted my DS and when I logged in, I was able to see the app again inside of the serverclass.
I still don't know what really happens and this isn't a real answer but at least it got the app back to some degree of usability.

View solution in original post

woodcock
Esteemed Legend

OK, I figured it out. I manually added this back into my serverclass.conf file:

[serverClass:SomeAppThatExists:app:YourUninstalledAppNameHere]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled

Then I rebooted my DS and when I logged in, I was able to see the app again inside of the serverclass.
I still don't know what really happens and this isn't a real answer but at least it got the app back to some degree of usability.

Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...