I had the same problem and it looks like a bug with the way Splunk validates the application installation, as it will look for it on the /opt/splunk/etc/apps directory even though this was overwritten by the deployment.conf file. My way to make the error go away was to create symbolic links in the /opt/splunk/etc/apps to the applications deployed in the /opt/splunk/etc/master-apps directory. This had to be done for each APP deployed via the deployment server. In this example, I deployed the TA add-on for SoS using the deployment server to push the APP to the cluster master and from there to the peers. [LAB]/opt/splunk/etc/apps # ln -s /opt/splunk/etc/master-apps/TA-sos TA-sos [LAB]/opt/splunk/etc/apps # ls -l TA-sos lrwxrwxrwx 1 root root 34 Jul 8 13:51 TA-sos -> /opt/splunk/etc/master-apps/TA-sos [LAB]/opt/splunk/etc/apps # ls -ld /opt/splunk/etc/master-apps/TA-sos drwx------ 7 root root 4096 Jul 8 13:51 /opt/splunk/etc/master-apps/TA-sos [LAB]/opt/splunk/etc/apps # This solved the issue (errors are no longer in splunkd.log), but I'm not a big fan of symbolic links and it's a manual step that you need to add to you MOP when deploying these apps; that is making me wonder if it's worth it to manage the cluster apps via the deployment server. I will try to log a support case for this. ... View more