topic Re: Why can't I push SH bundles? in Deployment Architecture

Why can't I push SH bundles?

ddrillic — Mon, 29 Jan 2018 20:02:25 GMT

When running the following - /opt/splunk/bin/splunk apply shcluster-bundle -target https://<SH Host>.<domain>.com:8089, I get the following -

Warning: Depending on the configuration changes being pushed, this command might initiate a rolling restart of the cluster members.  Please refer to the documentation for the details. Do you wish to continue? [y/n]: y
Your session is invalid.  Please login.
Splunk username: admin
Password: 
Search Head Cluster Deployer: The configuration bundle contains the following default apps: SplunkForwarder, SplunkLightForwarder, framework, gettingstarted, introspection_generator_addon, launcher, learned, legacy, sample_app, search, user-prefs.

It is strongly recommended that you not use the deployer to push default apps to the search head cluster members. Read the topic "Use the deployer to distribute apps and configuration updates" in the Distributed Search manual on docs.splunk.com for details.

If you are sure you want to do this, push the configuration bundle again using the "-push-default-apps true" option.

The cluster has been upgraded recently to 7.x.

What can this be?

Re: Why can't I push SH bundles?

ddrillic — Tue, 30 Jan 2018 00:04:29 GMT

I wonder if I can run the following -

/opt/splunk/bin/splunk apply shcluster-bundle -target https://<SH Host>.<domain>.com:8089 push-default-apps false

And the default Splunk apps shouldn't be on the deployer, right? so I wonder how they reached here...

Re: Why can't I push SH bundles?

somesoni2 — Tue, 30 Jan 2018 05:24:01 GMT

You're correct about those default apps shouldn't be there in the deployer (shcluster/apps dir). Were they there before your upgrade? May be check the timestamp to when they were copied.

Re: Why can't I push SH bundles?

ddrillic — Tue, 30 Jan 2018 12:16:25 GMT

What I see is that in production which is 6.x these default apps are there and the deployer doesn't complain whereas in stage after the upgrade to 7.x the deployer complain about them - somebody apparently changed the software ; -)

Re: Why can't I push SH bundles?

ddrillic — Tue, 30 Jan 2018 23:22:43 GMT

For the record, a sub-issue at What is the proper location of user-prefs.conf?

Re: Why can't I push SH bundles?

adonio — Tue, 30 Jan 2018 23:58:10 GMT

Hello @ddrillic,

answered on your other question regarding user-pref.conf first
the apps mentioned above, are native to splunk and exists in any new splunk install.
these apps can not be pushed in a bundle from deployer to search head cluster members.
with that being said, you can take you user-prefs.conf file and place it in a new app and push to members.
read more in this article:
http://docs.splunk.com/Documentation/Splunk/7.0.1/DistSearch/Migratefromstandalonesearchheads#Do_not_migrate_default_apps

in general steps, i will verify that there are no items in the local directory in the native splunk apps (the ones you mentioned). will pay specific attention to search and launcher, as users tend to save items in them.
then ill create a new app and name it "migration" or something of that sort. will place all files mentioned above in this app and push this app to the cluster members. make sure to have all configuration on the migration app and the app itself global

hope it helps