topic getting this error while applying distribution bundle in Splunk Search

getting this error while applying distribution bundle

hrithiktej — Thu, 21 Sep 2017 17:11:45 GMT

I have some apps that I deleted in slave-apps directory on our indexers and now our master apps on cluster master has these files and i want to push the distribution bundle but gives this error
In handler 'clustermastercontrol': No new bundle will be applied. The master and peers already have this bundle with bundle id = 9BF1726DFB2075A5E9149D2D00E8AE98

Re: getting this error while applying distribution bundle

sbbadri — Tue, 29 Sep 2020 15:50:32 GMT

@hrithiktej,

Problem is cluster master always have reference to all the apps available in the Indexer cluster. If you remove apps from cluster peers i.e., slave-apps. App will be reloaded again from CM's master-apps.

Please follow below steps in cluster master to resolve your issue.

1) Delete the apps which you don't want from $SPLUNK_HOME/etc/master-apps
2) Execute this command $SPLUNK_HOME/bin/splunk apply custer-bundle

Validation: Once you execute above command. login to any one of the peers. Apps should not be available.

3) Modify/place new app under $SPLUNK_HOME/etc/master-apps
4) Execute this command $SPLUNK_HOME/bin/splunk apply custer-bundle

For more details, check below link,
https://docs.splunk.com/Documentation/Splunk/6.6.3/Indexer/Manageappdeployment

I hope this helps you

Re: getting this error while applying distribution bundle

hrithiktej — Thu, 21 Sep 2017 17:49:42 GMT

Thank you i will try this and update you tomo. I have uploaded the unwanted app into master-apps and in slave-apps tomo i will delete the app from cluster master and then try distributing the bundl again.

Re: getting this error while applying distribution bundle

lfedak_splunk — Fri, 22 Sep 2017 00:15:51 GMT

Hey @krithiktej, if @sbbadri solved your problem, please don't forget to accept an answer! You can upvote posts as well. (Karma points will be awarded for either action.) Happy Splunking!

Re: getting this error while applying distribution bundle

hrithiktej — Fri, 22 Sep 2017 11:31:39 GMT

@sbbadri thanks this resolved my problem i deleted the unwanted app from master-apps directory and did a distributed push and it was succesful.

One more question after i redistribute the bundle which has config changes do i need a reboot for both indexers/peers or no ?

Re: getting this error while applying distribution bundle

sbbadri — Fri, 22 Sep 2017 13:30:27 GMT

No need. Redistribute command itself will take care of restart splunk service for config changes. Don't want to do it manually.

Re: getting this error while applying distribution bundle

hrithiktej — Fri, 22 Sep 2017 13:55:39 GMT

oh ok great thank you.