I am trying to deploy a searchhead app into etc/apps of each searchhead in a SHC, but without using deployer. The app content (inputs.conf) is slightly different on each SH (contains hostname) and thus cannot be pushed by deployer.
So, I am copying the host specific app onto each SH and restart the SHC. Below are the logs that I discovered when I do that:
11-21-2017 00:03:14.844 +0000 INFO ApplicationManager - Detected app creation: my_cool_app
11-21-2017 00:18:25.118 +0000 WARN ApplicationManager - Cannot import non-existent application: my_cool_app
After that, my custom app gets deleted from every SH.
So, the question is, what else do I need to do so that Splunk does not delete my app? It is my understanding, that it is still supported to deploy apps directly into etc/apps on a SHC member. And many OOB apps (alert_logevent, framework, search, gettingstarted, launcher, etc.) are deployed in that fashion and are not coming through the deployer.
... View more