Apps: To Disable or To Delete?

I feel like deleting is the cleaner approach, however there is a downside if you are talking about pre-distributed apps (like Splunk*Forwarder or sample_app). If you simple delete these apps, then next time you install a Splunk upgrade, these apps will get re-installed and may be enabled again (depending on their default packaged state.) However, if you had simple disabled these apps, the apps would have stayed disabled because the upgrade preserves that preference. (The local folder is not overwritten during the upgrade.)

We do this with the deployment process by creating a dummy (empty) application that contains only the local/app.conf file, which has the following content:

[install]
state = disabled

This way the app is removed initially, and if an upgrade occurs, at least the app does not get enabled again. Of course, I kind of liked the 3.x model for this slightly better, where one app could actually disable another app, but I also see how that could create other problems. At the moment, I think this is the "best" approach.

BTW, thanks to gkanapathy for pointing out this idea to me in the first place: http://www.splunk.com/support/forum:SplunkAdministration/4172