So we recently had clustering enabled in our environment and decided to remove it and now we keep getting the following error when starting our indexers: ERROR ApplicationManager - Unexpected duplicate app: _cluster. The indexer starts fine but what can I do to get rid of this message?
Look in /opt/splunk/etc/apps
for an entry called _cluster
. Remove it and restart splunk. The error should go away.
In my case I had to do a little extra. I was messing around trying to get the shuttl app to work. I somehow managed to create some duplicate buckets in my _internal
and _audit
indexes. Until I fixed the duplicates, splunk kept re-creating that _cluster
app (it was using that app to create a indexes.conf
which disabled the _internal
and _audit
indexes) whenever I tried to remove it.
Look in /opt/splunk/etc/apps
for an entry called _cluster
. Remove it and restart splunk. The error should go away.
In my case I had to do a little extra. I was messing around trying to get the shuttl app to work. I somehow managed to create some duplicate buckets in my _internal
and _audit
indexes. Until I fixed the duplicates, splunk kept re-creating that _cluster
app (it was using that app to create a indexes.conf
which disabled the _internal
and _audit
indexes) whenever I tried to remove it.