Hello team splunk.
Using Splunk 8.0.1 in clustered seach head mode. I cannot delete some apps on searchhead cluster from deployer. I remove the app on the deployer from ${SPLUNK_HOME}/etc/shcluster/apps and spread the new bundle to the shcluster using
splunk apply shcluster-bundle --answer-yes -target http://you-know:8089
the app is still present on the shcluster members under ${SPLUNK_HOME}/apps and accessible in the GUI. I noticed a log output in conf.log on the SH Captain containing
{"name":"my-undeletable-app","action":"preserved"}
What does "preserved" mean? Is there a way to prevent an app to be deleted? And if so, how can I "disable" prevention ?
Thank you very much
ivo
Does app has any lookups or local directories on search heads? This is not an internal app right?
Hello manjunathemti,
Yes, this is not an internal app.
There is a lookups directory with a reamde.md file in it, but no real lookups.
There is a default directory on the search heads.
do you have any idea why it cannot be removed?
Thank you very much
Ivo
readme.md should not be created in lookups directory. Check the permissions of that and also check the contents of app.conf in default directory if exists.