Issue with indexer recreating apps after manual deletion (400 Error) Splunk Enterprise v8.03, Ubuntu 18.04.

[jkujawa]

I have a couple of apps that I am trying to update on my Indexer (TA's) and am constantly seeing a 400 bad request error when trying to update them.

I ran the ./splunk remove app on the indexer and it successfully removes the app. Splunk is then restarted on the server. Within a couple of minutes, the folders reappear at the same old version.

What is going on with this and how to prevent the apps from recreating themselves?

I am running Splunk Enterprise v8.03 on Ubuntu 18.04.

[jkujawa · Accepted solution]

Found the issue. Turns out there were was a deployment server configuration with old apps that were pushed to the indexer from a previous employee.

[sensitive-thug]

Hi @jkujawa,

Thanks for asking a question! If you were able to resolve this issue, please click “Accept” directly below the answer to resolve the post.