Deployment Architecture

SHCluster: Deployer preserves apps instead of delete

ivohechmann
Explorer

Hello team splunk.

Using Splunk 8.0.1 in clustered seach head mode. I cannot delete some apps on searchhead cluster from deployer. I remove the app on the deployer from ${SPLUNK_HOME}/etc/shcluster/apps and spread the new bundle to the shcluster using

splunk apply shcluster-bundle --answer-yes -target http://you-know:8089

the app is still present on the shcluster members under ${SPLUNK_HOME}/apps and accessible in the GUI. I noticed a log output in conf.log on the SH Captain containing

{"name":"my-undeletable-app","action":"preserved"}

What does "preserved" mean? Is there a way to prevent an app to be deleted? And if so, how can I "disable" prevention ?

Thank you very much
ivo

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Does app has any lookups or local directories on search heads? This is not an internal app right?

0 Karma

ivohechmann
Explorer

Hello manjunathemti,

Yes, this is not an internal app.
There is a lookups directory with a reamde.md file in it, but no real lookups.
There is a default directory on the search heads.

do you have any idea why it cannot be removed?

Thank you very much
Ivo

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

readme.md should not be created in lookups directory. Check the permissions of that and also check the contents of app.conf in default directory if exists.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>