Hi All, Can anyone guide us in how to fix this problem, we had updated the serverclass.conf recently via deploymentserver and this message started popping out after updating the serverclass.conf in one of the splunk search head instances. When checked in the particular splunk instance under /opt/splunk/etc/apps/ this particular app detail was missing "TEST-ADMIN-all_indexers" but this app is still there in splunkweb -- Manage Apps -- TEST-ADMIN-all_indexers still in enable state. So by disabling and restarting the splunk service will fix this issue or we need to try some other method to fix this.
Splunk version 6.2.1
Thanks in advance.
↧