Unexpected duplicate app: _cluster

[aaronkorn]

So we recently had clustering enabled in our environment and decided to remove it and now we keep getting the following error when starting our indexers: ERROR ApplicationManager - Unexpected duplicate app: _cluster. The indexer starts fine but what can I do to get rid of this message?

[phemmer · Accepted solution]

Look in /opt/splunk/etc/apps for an entry called _cluster. Remove it and restart splunk. The error should go away.

In my case I had to do a little extra. I was messing around trying to get the shuttl app to work. I somehow managed to create some duplicate buckets in my _internal and _audit indexes. Until I fixed the duplicates, splunk kept re-creating that _cluster app (it was using that app to create a indexes.conf which disabled the _internal and _audit indexes) whenever I tried to remove it.