Automatic linux/nix-TA installation on indexer

[tfechner]

Hi,

At startup of our indexer beeing part of a cluster there is an error stating that we have 2 *nix-TA installed. One in /etc/apps and one in etc/slave-apps.
As we are using only the clustermaster to deploy apps the first place etc/apps is wrong and not used by our setup.
I deleted this app and after a restart the app is again there.
I did not install splunk with some special command line options.

So why is Splunk installing an app in the wrong possition and where is the configuration?

[vinod94 · Accepted solution]

Hi dyude, @tfechner ,

Can you try removing the app from cluster master and then push the bundle. Then, try deleting the app from etc/apps. Once the app is gone from etc/apps you can again install the app from cluster master.

I hope none of your indexers are connected as deployment client which has Nix app in the corresponding server class. Just mentioned it for the safe side.

[tfechner]

mh.. it's not this way:
I never installed the app in /etc/app. I always use the cluster-master.

I remove the wrong app, restart the peer and then the app is again in /etc/apps!
No deployment-client used.

[vinod94]

This link might help you..

https://docs.splunk.com/Documentation/Splunk/8.0.3/Indexer/Updatepeerconfigurations#Settings_that_yo...

[tfechner]

oh - nice to see.
But it is the offical splunk audit linux-TA "TA-linux_audit".
We will search if there is any file which is created by the SHC or similar

[vinod94]

Can you try moving the app which basically resides in cluster master to some other directory and then push the bundle(which basically will push the app without TA-nix) and see if the app is still in etc/apps on the slaves.

[tfechner]

ok - removed on CM this app - deployed bundle.
then updates to the recent version, and re-deploy.
works now.

[vinod94]

Glad to know that it worked.