topic Re: Search Head Cluster Deployer doesn't push ITSI apps in Installation

Search Head Cluster Deployer doesn't push ITSI apps

aguilard — Tue, 12 Dec 2023 20:14:37 GMT

Hello,

I'm trying to install Splunk ITSI 4.17.1 in a Search Head Cluster with Splunk Enterprise 9.1.2.

I already extract the .spl in the directory $SPLUNK_HOME$/etc/shcluster/apps but when I execute the command splunk apply shcluster-bundle it shows that it has deployed everything correctly but when I go to the Search Heads none of the ITSI apps are deployed.

i just made a test deploying another simple app just for testing purposes and it worked.

Do you have any idea?

Re: Search Head Cluster Deployer doesn't push ITSI apps

gcusello — Wed, 13 Dec 2023 08:30:57 GMT

Hi @aguilard,

have you error messages on the Deployer?

have you enough disk space on the Deployer? it's required some additional disk space on it.

what's the owner of the folders and files? it must be splunk.

Which user are you using to install and run splunk?

Ciao.

Giuseppe

Re: Search Head Cluster Deployer doesn't push ITSI apps

aguilard — Wed, 13 Dec 2023 09:05:02 GMT

Hello @gcusello ,

I do not have error messages on the Deployer.

I have plenty of space in the disk of the Deployer, I already checked.

The owner of the files is splunk and it's been installed and ran with user Splunk.

The thing that I noticed 20 minutes ago and I do not why is when the deployer pushes the ITSI apps to /opt/splunk/var/run/splunk/apps it adds at the of the folder the word "-local" and I just checked that in other installations that I manage it doesn't occur.

Thanks for the response

Re: Search Head Cluster Deployer doesn't push ITSI apps

gcusello — Wed, 13 Dec 2023 10:04:04 GMT

Hi @aguilard,

this path isn't correct, check if you configured in serverclasses.conf the targetRepositoryLocation parameter that's used to configure where to push apps, default is $SPLUNK_HOME/etc/apps.

Ciao.

Giuseppe

Re: Search Head Cluster Deployer doesn't push ITSI apps

aguilard — Wed, 13 Dec 2023 11:35:46 GMT

Ciao @gcusello ,

Maybe I didn't explain myself correctly. I meant that when the deployer moves the apps to /opt/splunk/var/run/splunk/deploy/apps it created the apps with "-local" But i just discovered that it was for a misconfiguration in the app.conf file deploy mode.

I already fixed it and now the SHs have all the ITSI apps on the etc/apps directory.

But I'm facing a new problem, when I start ITSI I got this message

But it has no sense because it is the first installation...

Thanks for your response and time

Re: Search Head Cluster Deployer doesn't push ITSI apps

gcusello — Wed, 13 Dec 2023 13:12:54 GMT

Hi @aguilard,

it's avery strange behavior: open a cae t sSplunk Support.

Ciao.

Giuseppe

Re: Search Head Cluster Deployer doesn't push ITSI apps

aguilard — Sat, 16 Dec 2023 11:43:55 GMT

I fixed the problem simply restarting the cluster and I worked 🙂

Thanks 🙂

Re: Search Head Cluster Deployer doesn't push ITSI apps

gcusello — Sun, 17 Dec 2023 10:14:31 GMT

Hi @aguilard,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉