topic Re: Troubleshoot why apply shcluster-bundle does not work / takes very long time in Deployment Architecture

How can I Troubleshoot why apply shcluster-bundle does not work / takes very long time?

erw550 — Tue, 31 May 2022 13:54:05 GMT

Hello,

When I run the splunk apply cluster-bundle command it seems to create a bundle for all apps in /$SPLUNK_HOME/etc/shcluster/apps to /$SPLUNK_HOME/var/run/splunk/deploy/apps. The last modified date on all app catalogs in /$SPLUNK_HOME/var/run/splunk/deploy/apps is always the date of when I last ran the apply shcluster bundle command. We have merge_to_default set, could that have something to do with all apps being pushed to the search head cluster regardless if there has been any change in the apps?

How can I troubleshoot what the problem could be? If the apply command finishes it can take up to hours but usually it's something that times out.

Re: Troubleshoot why apply shcluster-bundle does not work / takes very long time

gcusello — Mon, 30 May 2022 15:14:01 GMT

Hi @erw550,

you can search in _internal errors in bundle replication.

The reasons I encountered usually are two:

not enough disk space in the Deployer for bundle creation;
the bundle dimension exceed the limit of 5 GB (default).

In the first case, you have to give more disk space to you Deployer.

In the second case, you have to blacklist some lookup in the apps to deploy.

You can find information about this issue at https://docs.splunk.com/Documentation/Splunk/8.2.6/DistSearch/Limittheknowledgebundlesize or at https://community.splunk.com/t5/Getting-Data-In/Blacklisting-certain-data-from-replicating-in-a-bundle/m-p/30043

Ciao.

Giuseppe