All Apps and Add-ons

Automatic linux/nix-TA installation on indexer

tfechner
Path Finder

Hi,

At startup of our indexer beeing part of a cluster there is an error stating that we have 2 *nix-TA installed. One in /etc/apps and one in etc/slave-apps.
As we are using only the clustermaster to deploy apps the first place etc/apps is wrong and not used by our setup.
I deleted this app and after a restart the app is again there.
I did not install splunk with some special command line options.

So why is Splunk installing an app in the wrong possition and where is the configuration?

Labels (1)
Tags (1)
0 Karma
1 Solution

vinod94
Contributor

Hi dyude, @tfechner ,

Can you try removing the app from cluster master and then push the bundle. Then, try deleting the app from etc/apps. Once the app is gone from etc/apps you can again install the app from cluster master.

I hope none of your indexers are connected as deployment client which has Nix app in the corresponding server class. Just mentioned it for the safe side.

View solution in original post

0 Karma

vinod94
Contributor

Hi dyude, @tfechner ,

Can you try removing the app from cluster master and then push the bundle. Then, try deleting the app from etc/apps. Once the app is gone from etc/apps you can again install the app from cluster master.

I hope none of your indexers are connected as deployment client which has Nix app in the corresponding server class. Just mentioned it for the safe side.

0 Karma

tfechner
Path Finder

mh.. it's not this way:
I never installed the app in /etc/app. I always use the cluster-master.

I remove the wrong app, restart the peer and then the app is again in /etc/apps!
No deployment-client used.

0 Karma

vinod94
Contributor
0 Karma

tfechner
Path Finder

oh - nice to see.
But it is the offical splunk audit linux-TA "TA-linux_audit".
We will search if there is any file which is created by the SHC or similar

0 Karma

vinod94
Contributor

Can you try moving the app which basically resides in cluster master to some other directory and then push the bundle(which basically will push the app without TA-nix) and see if the app is still in etc/apps on the slaves.

0 Karma

tfechner
Path Finder

ok - removed on CM this app - deployed bundle.
then updates to the recent version, and re-deploy.
works now.

0 Karma

vinod94
Contributor

Glad to know that it worked.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...