A further step which may be useful: I encountered the same issue as this but the above steps were NOT successful in removing the associated app. The exact reason is still unclear, the only hints I have found were an event log generated during the bundle push, which you can find with the following search:  index=_internal sourcetype=splunkd_conf component=confdeployment "data.task"=downloadDeployableApps The event is a JSON object containing an element for each app; built in apps that do not get pushed by the deployer will have a value data.apps{}.action=preserved, ones which are pushed will have data.apps{}.action=matched. In this case, the app showed as preserved, despite not being one of the built in defaults. Cluster members would not delete it even though all local configs were gone, and the app had been removed from the deployer's bundle, and neither debug/refresh nor rolling restart helped. The eventual solution was: create a dummy app with the same name - literally an empty directory - on the deployer push the bundle with this directory this made the SHC members move the existing configs into a default.old.<date>-<time> directory Repeated the above post's steps for deleting this dir and local configs, just to be sure Pushed bundle again - app successfully deleted ... View more