topic Re: Fire Brigade - ERROR ApplicationManager - Unexpected duplicate app: TA-fire_brigade in All Apps and Add-ons

Fire Brigade - ERROR ApplicationManager - Unexpected duplicate app: TA-fire_brigade

greich — Mon, 28 Sep 2020 16:05:21 GMT

Config: Splunk 6.x, Search head pooling, cluster of indexers.

Error on indexers:
ERROR ApplicationManager - Unexpected duplicate app: TA-fire_brigade

On the indexers we have under $SPLUNK_HOME/etc:

apps/TA-Fire_brigade -> lookup and monitored_index.csv
slave-apps/TA-Fire_brigade -> apps, macros, transforms, etc.
users/splunk-system-user/TA-Fire_brigade -> metadata, savedsearches

cant find anything actually duplicate

Re: Fire Brigade - ERROR ApplicationManager - Unexpected duplicate app: TA-fire_brigade

Jason — Tue, 11 Mar 2014 17:18:00 GMT

The problem is that the app (folder) TA-Fire_brigade exists in both etc/apps and etc/slave-apps. Splunk wants you to have the app in one place or the other, not both.

Re: Fire Brigade - ERROR ApplicationManager - Unexpected duplicate app: TA-fire_brigade

greich — Mon, 28 Sep 2020 16:08:55 GMT

don't seem to be able to comment your comment.
nope. renamed the cluster app, but Splunk is still complaining:

03-15-2014 04:53:08.384 +0000 ERROR ProcessTracker - (child_923039__RollFixMetadata) ApplicationManager - Unexpected duplicate app: TA-fire_brigade

03-15-2014 04:55:23.011 +0000 ERROR ProcessTracker - (child_923211__RollFixMetadata) ApplicationManager - Unexpected duplicate app: TA-fire_brigade

03-15-2014 05:14:45.425 +0000 INFO ClusterSlaveConfigReloader - The following new apps were downloaded in the new bundle - 'TA-fire_brigade-clustapp'.

03-15-2014 05:14:45.425 +0000 INFO ClusterSlaveConfigReloader - The following apps were removed from the downloaded bundle -'TA-fire_brigade'.

splunk @ /opt/splunk/etc # find -name brigade -type d

./apps/TA-fire_brigade

./users/splunk-system-user/TA-fire_brigade

./slave-apps/TA-fire_brigade-clustapp

./slave-apps.old/TA-fire_brigade

Re: Fire Brigade - ERROR ApplicationManager - Unexpected duplicate app: TA-fire_brigade

greich — Mon, 17 Mar 2014 08:54:36 GMT

removed the slave app altogether. Doesn't explain tho how the etc/apps got there (not in serverclass.conf).

Re: Fire Brigade - ERROR ApplicationManager - Unexpected duplicate app: TA-fire_brigade

apfender_splunk — Fri, 27 Jun 2014 10:30:29 GMT

slave-apps is read only. Only Cluster Master can write. If an app writes to it's own files it can not live in slave-apps obvisiouly. Do not deploy with CM then, deploy manually.

Re: Fire Brigade - ERROR ApplicationManager - Unexpected duplicate app: TA-fire_brigade

vchepkov — Mon, 28 Sep 2020 17:48:33 GMT

It's a bug in splunk:

http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues

Clustering error "unexpected duplicate app" for apps in both $SPLUNK_HOME/etc/apps and $SPLUNK_HOME/etc/slave-apps. When a lookup or a configuration file is created it goes to the /etc/apps, while the same file may exists in the /etc/slave-apps, causing this warning. (SPL-70433)

Re: Fire Brigade - ERROR ApplicationManager - Unexpected duplicate app: TA-fire_brigade

ckurtz — Mon, 28 Sep 2020 18:59:21 GMT

Often a duplicate app gets created if Splunk has to modify a file in slave_apps and cannot -- I've seen this when, for example, the app in slave_apps contains an unencrypted password and Splunk wants to encrypt it. It can't write it back to slave_apps since it's read only, so it writes it to the normal apps directory. The solution is to have the app with the password be pushed to the slaves in a different (out of band) way, or to have a secondary app that is used for this.

An example might be a cluster-bundled app (so it's pushed to slave_apps) called company_data that doesn't contain the plaintext password and a local apps/company_data_unique that is manually copied to all the indexers.

Re: Fire Brigade - ERROR ApplicationManager - Unexpected duplicate app: TA-fire_brigade

ppablo — Thu, 22 Oct 2015 20:55:30 GMT

FYI, Fire Brigade version 2 will no longer be updated (latest version is 2.0.3). The newer versions 2.0.4 and higher will now be available with the original “Fire Brigade” app on Splunkbase which was just updated to support Splunk 6.3. This is noted on the page for Fire Brigade on Splunkbase:
https://splunkbase.splunk.com/app/1581/

If you have any questions, ping the developer of the app @sowings

Cheers!