A further step which may be useful: I encountered the same issue as this but the above steps were NOT successful in removing the associated app. The exact reason is still unclear, the only hints I have found were an event log generated during the bundle push, which you can find with the following search:  index=_internal sourcetype=splunkd_conf component=confdeployment "data.task"=downloadDeployableApps The event is a JSON object containing an element for each app; built in apps that do not get pushed by the deployer will have a value data.apps{}.action=preserved, ones which are pushed will have data.apps{}.action=matched. In this case, the app showed as preserved, despite not being one of the built in defaults. Cluster members would not delete it even though all local configs were gone, and the app had been removed from the deployer's bundle, and neither debug/refresh nor rolling restart helped. The eventual solution was: create a dummy app with the same name - literally an empty directory - on the deployer push the bundle with this directory this made the SHC members move the existing configs into a default.old.<date>-<time> directory Repeated the above post's steps for deleting this dir and local configs, just to be sure Pushed bundle again - app successfully deleted ... View more

The scope of your question is very broad, I think to answer it we need more specifics. What are you using nxlog and emite for, and what do you hope to achieve by sending data to splunk (or sending it from splunk to the other tools)? ... View more

To do it within Splunk, I think what you want to look at is this: https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Overridedefaulthostassignments ... View more

Yes, uForwarder has read permissions (it's running as root currently), and outputs.conf is delivered as another app. Pretty sure it's functional though, otherwise how would the metrics/splunkd.log etc be getting sent? Also: ~# /opt/splunkforwarder/bin/splunk list forward-server Active forwards: $splunk_ip:9997 Configured but inactive forwards: None ... View more