Skip to content

ES installation keeping old files on the deployer #895

@yaroslav-nakonechnikov

Description

@yaroslav-nakonechnikov
[splunk@splunk-e-50854-deployer-0 splunk]$ ls ./etc/apps/SplunkEnterpriseSecuritySuite/install
DA-ESS-AccessProtection-7.3.4-173447.spl    SA-AuditAndDataProtection-8.3.0-218206.spl  SA-Utils-8.3.0-218206.spl                                   Splunk_ML_Toolkit-5.6.0-1747023098169.tgz
DA-ESS-AccessProtection-8.3.0-218206.spl    SA-ContentVersioning-8.3.0-218206.spl       SplunkEnterpriseSecuritySuite-7.3.4_20251120150708_308369   Splunk_SA_CIM-5.3.3-1156.tgz
DA-ESS-EndpointProtection-7.3.4-173447.spl  SA-EndpointProtection-7.3.4-173447.spl      SplunkEnterpriseSecuritySuite-7.3.4_20251120153334_51434    Splunk_SA_CIM-6.3.0-1488.tgz
DA-ESS-EndpointProtection-8.3.0-218206.spl  SA-EndpointProtection-8.3.0-218206.spl      SplunkEnterpriseSecuritySuite-7.3.4_20251120155525_752700   Splunk_SA_Scientific_Python_linux_x86_64-3.2.2-0.tgz
DA-ESS-IdentityManagement-7.3.4-173447.spl  SA-EntitlementManagement-8.3.0-218206.spl   SplunkEnterpriseSecuritySuite-8.3.0_20251121114652_969956   Splunk_SA_Scientific_Python_linux_x86_64-3.2.4-0.tgz
DA-ESS-IdentityManagement-8.3.0-218206.spl  SA-IdentityManagement-7.3.4-173447.spl      SplunkEnterpriseSecuritySuite-8.3.0_20251121131309_502126   Splunk_SA_Scientific_Python_windows_x86_64-3.2.2-0.tgz
DA-ESS-NetworkProtection-7.3.4-173447.spl   SA-IdentityManagement-8.3.0-218206.spl      SplunkEnterpriseSecuritySuite-8.3.0_20251121134404_1030682  Splunk_SA_Scientific_Python_windows_x86_64-3.2.4-0.tgz
DA-ESS-NetworkProtection-8.3.0-218206.spl   SA-NetworkProtection-7.3.4-173447.spl       SplunkEnterpriseSecuritySuite-8.3.0_20251124080231_899605   Splunk_TA_ueba-3.2.0-73256.spl
DA-ESS-ThreatIntelligence-7.3.4-173447.spl  SA-NetworkProtection-8.3.0-218206.spl       SplunkEnterpriseSecuritySuite-8.3.0_20251124083821_157784   deprecated_apps.txt
DA-ESS-ThreatIntelligence-8.3.0-218206.spl  SA-ThreatIntelligence-7.3.4-173447.spl      SplunkEnterpriseSecuritySuite-8.3.0_20251124110814_1046749  dlx-app_1.0.0-1086.tgz
DA-ESS-UEBA_1.4.0-13755.tgz                 SA-ThreatIntelligence-8.3.0-218206.spl      SplunkEnterpriseSecuritySuite-8.3.0_20251124114954_776491   installable_apps.txt
SA-AccessProtection-7.3.4-173447.spl        SA-UEBA-7.3.4-173447.spl                    SplunkEnterpriseSecuritySuite-8.3.0_20251125080310_1014973  missioncontrol_6.3.0-120127.tgz
SA-AccessProtection-8.3.0-218206.spl        SA-UEBA-8.3.0-218206.spl                    SplunkEnterpriseSecuritySuite-8.3.0_20251125083815_355131   ocsf_cim_addon_for_splunk-1.0.0-0346.spl
SA-AuditAndDataProtection-7.3.4-173447.spl  SA-Utils-7.3.4-173447.spl                   Splunk_ML_Toolkit-5.5.0-1729097923988.tgz                   splunkcloud
[splunk@splunk-e-50854-deployer-0 splunk]$ ls ./etc/shcluster/apps/SplunkEnterpriseSecuritySuite/install
DA-ESS-AccessProtection-7.3.4-173447.spl    SA-ContentVersioning-8.3.0-218206.spl      SplunkEnterpriseSecuritySuite-7.3.4_20251120150708_308369   Splunk_SA_CIM-6.3.0-1488.tgz
DA-ESS-AccessProtection-8.3.0-218206.spl    SA-EndpointProtection-7.3.4-173447.spl     SplunkEnterpriseSecuritySuite-7.3.4_20251120153334_51434    Splunk_SA_Scientific_Python_linux_x86_64-3.2.2-0.tgz
DA-ESS-EndpointProtection-7.3.4-173447.spl  SA-EndpointProtection-8.3.0-218206.spl     SplunkEnterpriseSecuritySuite-7.3.4_20251120155525_752700   Splunk_SA_Scientific_Python_linux_x86_64-3.2.4-0.tgz
DA-ESS-EndpointProtection-8.3.0-218206.spl  SA-EntitlementManagement-8.3.0-218206.spl  SplunkEnterpriseSecuritySuite-8.3.0                         Splunk_SA_Scientific_Python_windows_x86_64-3.2.2-0.tgz
DA-ESS-IdentityManagement-7.3.4-173447.spl  SA-IdentityManagement-7.3.4-173447.spl     SplunkEnterpriseSecuritySuite-8.3.0_20251121114652_969956   Splunk_SA_Scientific_Python_windows_x86_64-3.2.4-0.tgz
DA-ESS-IdentityManagement-8.3.0-218206.spl  SA-IdentityManagement-8.3.0-218206.spl     SplunkEnterpriseSecuritySuite-8.3.0_20251121131309_502126   Splunk_TA_ueba-3.2.0-73256.spl
DA-ESS-NetworkProtection-7.3.4-173447.spl   SA-NetworkProtection-7.3.4-173447.spl      SplunkEnterpriseSecuritySuite-8.3.0_20251121134404_1030682  deprecated_apps.txt
DA-ESS-NetworkProtection-8.3.0-218206.spl   SA-NetworkProtection-8.3.0-218206.spl      SplunkEnterpriseSecuritySuite-8.3.0_20251124080231_899605   dlx-app_1.0.0-1086.tgz
DA-ESS-ThreatIntelligence-7.3.4-173447.spl  SA-ThreatIntelligence-7.3.4-173447.spl     SplunkEnterpriseSecuritySuite-8.3.0_20251124083821_157784   installable_apps.txt
DA-ESS-ThreatIntelligence-8.3.0-218206.spl  SA-ThreatIntelligence-8.3.0-218206.spl     SplunkEnterpriseSecuritySuite-8.3.0_20251124110814_1046749  missioncontrol_6.3.0-120127.tgz
DA-ESS-UEBA_1.4.0-13755.tgz                 SA-UEBA-7.3.4-173447.spl                   SplunkEnterpriseSecuritySuite-8.3.0_20251124114954_776491   ocsf_cim_addon_for_splunk-1.0.0-0346.spl
SA-AccessProtection-7.3.4-173447.spl        SA-UEBA-8.3.0-218206.spl                   SplunkEnterpriseSecuritySuite-8.3.0_20251125080310_1014973  splunkcloud
SA-AccessProtection-8.3.0-218206.spl        SA-Utils-7.3.4-173447.spl                  Splunk_ML_Toolkit-5.5.0-1729097923988.tgz
SA-AuditAndDataProtection-7.3.4-173447.spl  SA-Utils-8.3.0-218206.spl                  Splunk_ML_Toolkit-5.6.0-1747023098169.tgz
SA-AuditAndDataProtection-8.3.0-218206.spl  SplunkEnterpriseSecuritySuite-7.3.4        Splunk_SA_CIM-5.3.3-1156.tgz
[splunk@splunk-e-50854-deployer-0 splunk]$ ls ./var/run/splunk/deploy/apps/SplunkEnterpriseSecuritySuite/install
DA-ESS-AccessProtection-7.3.4-173447.spl    SA-ContentVersioning-8.3.0-218206.spl      SplunkEnterpriseSecuritySuite-7.3.4_20251120150708_308369   Splunk_SA_CIM-6.3.0-1488.tgz
DA-ESS-AccessProtection-8.3.0-218206.spl    SA-EndpointProtection-7.3.4-173447.spl     SplunkEnterpriseSecuritySuite-7.3.4_20251120153334_51434    Splunk_SA_Scientific_Python_linux_x86_64-3.2.2-0.tgz
DA-ESS-EndpointProtection-7.3.4-173447.spl  SA-EndpointProtection-8.3.0-218206.spl     SplunkEnterpriseSecuritySuite-7.3.4_20251120155525_752700   Splunk_SA_Scientific_Python_linux_x86_64-3.2.4-0.tgz
DA-ESS-EndpointProtection-8.3.0-218206.spl  SA-EntitlementManagement-8.3.0-218206.spl  SplunkEnterpriseSecuritySuite-8.3.0                         Splunk_SA_Scientific_Python_windows_x86_64-3.2.2-0.tgz
DA-ESS-IdentityManagement-7.3.4-173447.spl  SA-IdentityManagement-7.3.4-173447.spl     SplunkEnterpriseSecuritySuite-8.3.0_20251121114652_969956   Splunk_SA_Scientific_Python_windows_x86_64-3.2.4-0.tgz
DA-ESS-IdentityManagement-8.3.0-218206.spl  SA-IdentityManagement-8.3.0-218206.spl     SplunkEnterpriseSecuritySuite-8.3.0_20251121131309_502126   Splunk_TA_ueba-3.2.0-73256.spl
DA-ESS-NetworkProtection-7.3.4-173447.spl   SA-NetworkProtection-7.3.4-173447.spl      SplunkEnterpriseSecuritySuite-8.3.0_20251121134404_1030682  deprecated_apps.txt
DA-ESS-NetworkProtection-8.3.0-218206.spl   SA-NetworkProtection-8.3.0-218206.spl      SplunkEnterpriseSecuritySuite-8.3.0_20251124080231_899605   dlx-app_1.0.0-1086.tgz
DA-ESS-ThreatIntelligence-7.3.4-173447.spl  SA-ThreatIntelligence-7.3.4-173447.spl     SplunkEnterpriseSecuritySuite-8.3.0_20251124083821_157784   installable_apps.txt
DA-ESS-ThreatIntelligence-8.3.0-218206.spl  SA-ThreatIntelligence-8.3.0-218206.spl     SplunkEnterpriseSecuritySuite-8.3.0_20251124110814_1046749  missioncontrol_6.3.0-120127.tgz
DA-ESS-UEBA_1.4.0-13755.tgz                 SA-UEBA-7.3.4-173447.spl                   SplunkEnterpriseSecuritySuite-8.3.0_20251124114954_776491   ocsf_cim_addon_for_splunk-1.0.0-0346.spl
SA-AccessProtection-7.3.4-173447.spl        SA-UEBA-8.3.0-218206.spl                   SplunkEnterpriseSecuritySuite-8.3.0_20251125080310_1014973  splunkcloud
SA-AccessProtection-8.3.0-218206.spl        SA-Utils-7.3.4-173447.spl                  Splunk_ML_Toolkit-5.5.0-1729097923988.tgz
SA-AuditAndDataProtection-7.3.4-173447.spl  SA-Utils-8.3.0-218206.spl                  Splunk_ML_Toolkit-5.6.0-1747023098169.tgz
SA-AuditAndDataProtection-8.3.0-218206.spl  SplunkEnterpriseSecuritySuite-7.3.4        Splunk_SA_CIM-5.3.3-1156.tgz

it is expected, that old files are removed from deployer automatically

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions