Deployment Architecture

Why do we see apps on the forwarder which are not on the deployment server?

danielbb
Motivator

We see on the UF -

 

 

 

/opt/splunkforwarder/etc/apps
$ \ls -tlr
total 48
drwxr-xr-x   4 splunk   splunk         4 Apr 15  2019 SplunkUniversalForwarder
drwxr-xr-x   4 splunk   splunk         4 Apr 15  2019 introspection_generator_addon
drwxr-xr-x   4 splunk   splunk         4 Apr 15  2019 search
drwxr-xr-x   3 splunk   splunk         3 Apr 15  2019 splunk_httpinput
drwxr-xr-x   5 splunk   splunk         5 Apr 15  2019 learned

 

 

 

 

These apps are not on the deployment server and they interfere with the configurations on the forwarder.

Why are they there and what can be done to remove them?

Labels (1)
Tags (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @danielbb 

These are default apps they come along with UF installation, if you wanted to remove them you might end up having issues as some of default/ conf files getting used by forwarder. There is no docs around what are default apps and their purpose.

If the apps in your DS are conflicting then you shall rename them on DS, i would not modify the names of these default apps on forwarder but you give a try and see the impact with full backup on before.

--

An upvote would be appreciated if this reply helps!

View solution in original post

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @danielbb 

These are default apps they come along with UF installation, if you wanted to remove them you might end up having issues as some of default/ conf files getting used by forwarder. There is no docs around what are default apps and their purpose.

If the apps in your DS are conflicting then you shall rename them on DS, i would not modify the names of these default apps on forwarder but you give a try and see the impact with full backup on before.

--

An upvote would be appreciated if this reply helps!

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...