Local app from Seach Head Cluster (SHC) member is removed on bundle push

Applicability

Splunk Enterprise Search Head Cluster (SHC)

Description

JDK has been installed to the search head members in SH Cluster as a locally managed app and JDK app is removed on bundle push from deployer while some apps like user-prefs or search & reporting app is not removed.
 

Investigation

The symptom (local app is removed when the app is removed from deployer) is by design and it is in line with what is described in the following Splunk doc:

Reference
Where to place the configuration bundle on the deployer

To delete an app that you previously pushed, remove it from the configuration bundle. When you next push the bundle, each member will delete it from its own file system. 

Note: If you need to remove an app, inspect its app.conf file to make sure that you have configured: state = enabled. If state = disabled, the deployer will not remove the app even if you remove it from the configuration bundle.

There is an exception. The following category apps will **NOT** be removed on bundle push even though they do not exist in the deployer

* apps that are already disabled, for example: SplunkLightForwarder.
* undeletable apps, e.g. search
* apps that ship with core splunkd, for example: learned.
 

Resolution

JDK app can be placed outside of $SPLUNK_HOME/etc/apps folder. This way, it will not be affected by any bundle push from the deployer.
 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release