Getting Data In

Issue with indexer recreating apps after manual deletion (400 Error) Splunk Enterprise v8.03, Ubuntu 18.04.

jkujawa
Explorer

I have a couple of apps that I am trying to update on my Indexer (TA's) and am constantly seeing a 400 bad request error when trying to update them.

I ran the ./splunk remove app on the indexer and it successfully removes the app. Splunk is then restarted on the server. Within a couple of minutes, the folders reappear at the same old version.

What is going on with this and how to prevent the apps from recreating themselves?

I am running Splunk Enterprise v8.03 on Ubuntu 18.04.

0 Karma
1 Solution

jkujawa
Explorer

Found the issue. Turns out there were was a deployment server configuration with old apps that were pushed to the indexer from a previous employee.

View solution in original post

jkujawa
Explorer

Found the issue. Turns out there were was a deployment server configuration with old apps that were pushed to the indexer from a previous employee.

sensitive-thug
Splunk Employee
Splunk Employee

Hi @jkujawa,

Thanks for asking a question! If you were able to resolve this issue, please click “Accept” directly below the answer to resolve the post.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...