All Apps and Add-ons

How to prevent a custom app from being deleted in SHC nodes?

splunkIT
Splunk Employee
Splunk Employee

I am trying to deploy a searchhead app into etc/apps of each searchhead in a SHC, but without using deployer. The app content (inputs.conf) is slightly different on each SH (contains hostname) and thus cannot be pushed by deployer.

So, I am copying the host specific app onto each SH and restart the SHC. Below are the logs that I discovered when I do that:

11-21-2017 00:03:14.844 +0000 INFO ApplicationManager - Detected app creation: my_cool_app
11-21-2017 00:18:25.118 +0000 WARN ApplicationManager - Cannot import non-existent application: my_cool_app

After that, my custom app gets deleted from every SH.

So, the question is, what else do I need to do so that Splunk does not delete my app? It is my understanding, that it is still supported to deploy apps directly into etc/apps on a SHC member. And many OOB apps (alert_logevent, framework, search, gettingstarted, launcher, etc.) are deployed in that fashion and are not coming through the deployer.

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

You absolutely need deployer to deploy an app to SHC. You can't deploy the app directly on the SH. Since, you need different version (in terms of the configs) to be deployed to different members, you can try this workaround.

1) In the apps that you want to push to SHC members, move/merge all configuration from <app_name>/default into <app_name>/localdirectory.
2) On the deployer, create an app with same name <app_name> with just default directory. Inside default directory, just place the app.conf from original app (from app title)
3)Deploy the apps from deployer, with just default directory to SHC members.
4) Manually copy the app you created in step 1 (without default directory) to all SHC members in etc/apps.
5) Rolling restart SHC.

ashwinipatil007
New Member

@somesoni2 i am facing the same issue here,i do not have the deployer instance ,so what is the other way to create app in SH without deployer?
also why the app gets deleted when we create it directly on search head?
any help would be great!

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...