How to decommission a Deployment Server without removing the apps it has deployed?

[anewell]

We have a Deployment server within our Splunk estate. For a variety of political & operational reasons, we have decided to do endpoint configuration management using different tools.

How do I decommission a Deployment Server without removing the Apps it has deployed? I do not want to disturb the existing configuration state for client endpoints. Am I looking at removing deploymentclient.conf from each endpoint individually? It seems that any other approach - Removing server classes, removing apps, etc. will result in client endpoints deleting their local copy of the app.

One approach I was considering - Would it work if I point the DNS record for my existing DS to a new Deployment Server instance, one that is minimally configured. Does that result in the endpoint removing the apps managed by the prior DS?

Thanks for any thoughts or guidance.

[cpetterborg]

If you have a new, minimally-configured deployment server that you point to with the DNS record, the apps already deployed to the forwarders will probably be removed. If the forwarders can't talk to a deployment server, they don't make any changes to their apps.

I suggest that you just turn the deployment server service off on your current deployment server, and it should work fine. They will not talk to a deployment server, they won't make changes (remove apps) and you can modify the apps' files that are on the hosts. The forwarders will still try to contact the deployment server, so you may wish to change the deploymentclient.conf file (the one that you deploy) to only contact (phone home) the deployment server once a week so that it won't do that too much on the forwarders, but you could revive your deployment server in the future.