We've filed a bug for this issue, SPL-108220. It has now been added to the known issues for both 6.3.0 and 6.3.1.
SPL-108220: Unable to deploy an app through Deployment Server Forwarder Management. Error: app= was already installed via search head cluster deployer, UI, CLI, or REST API; it may not be overridden via deployment server; remove existing app= via search head cluster deployer, UI, CLI, or REST API if you wish to install it via deployment server.
The way Splunk detects SHC "Deployer" managed apps (or generally: apps installed via UI, CLI, or REST API) in the client is by the presence of a setting, install_source_checksum in app.conf. If an app which was deployed by a Deployment Servers Forwarder Management contains an app.conf file with an install_source_checksum setting, then the reported error will occur and the app cannot be updated. One way this could happen is if an app was installed through the web gui on a Search Head and then copied to the deployment_apps repository and subsequently pushed to clients. When installing through the gui, it writes this checksum to the configuration file. Here is an example of how that looks:
$SPLUNK_HOME/etc/app//default/app.conf:
[install]
install_source_checksum = 0f98de8a93964bc7d52e79c7fb834b67ed739eaz
If that setting is removed prior to deploying the app the first time, the issue can be avoided. However, if you have already deployed the app, I don't believe it can be corrected unless this setting is removed from each client manually and the originating app on the Deployment Server. This should be addressed in a future release, currently targeted for 6.3.2.
... View more