SHCluster: Deployer preserves apps instead of delete

[ivohechmann]

Hello team splunk.

Using Splunk 8.0.1 in clustered seach head mode. I cannot delete some apps on searchhead cluster from deployer. I remove the app on the deployer from ${SPLUNK_HOME}/etc/shcluster/apps and spread the new bundle to the shcluster using

splunk apply shcluster-bundle --answer-yes -target http://you-know:8089

the app is still present on the shcluster members under ${SPLUNK_HOME}/apps and accessible in the GUI. I noticed a log output in conf.log on the SH Captain containing

{"name":"my-undeletable-app","action":"preserved"}

What does "preserved" mean? Is there a way to prevent an app to be deleted? And if so, how can I "disable" prevention ?

Thank you very much
ivo

[manjunathmeti]

Does app has any lookups or local directories on search heads? This is not an internal app right?

[ivohechmann]

Hello manjunathemti,

Yes, this is not an internal app.
There is a lookups directory with a reamde.md file in it, but no real lookups.
There is a default directory on the search heads.

do you have any idea why it cannot be removed?

Thank you very much
Ivo

[manjunathmeti]

readme.md should not be created in lookups directory. Check the permissions of that and also check the contents of app.conf in default directory if exists.