All Apps and Add-ons
Highlighted

Automatic linux/nix-TA installation on indexer

Path Finder

Hi,

At startup of our indexer beeing part of a cluster there is an error stating that we have 2 *nix-TA installed. One in /etc/apps and one in etc/slave-apps.
As we are using only the clustermaster to deploy apps the first place etc/apps is wrong and not used by our setup.
I deleted this app and after a restart the app is again there.
I did not install splunk with some special command line options.

So why is Splunk installing an app in the wrong possition and where is the configuration?

Labels (1)
Tags (1)
0 Karma
Highlighted

Re: Automatic linux/nix-TA installation on indexer

Contributor

Hi dyude, @tfechner ,

Can you try removing the app from cluster master and then push the bundle. Then, try deleting the app from etc/apps. Once the app is gone from etc/apps you can again install the app from cluster master.

I hope none of your indexers are connected as deployment client which has Nix app in the corresponding server class. Just mentioned it for the safe side.

View solution in original post

0 Karma
Highlighted

Re: Automatic linux/nix-TA installation on indexer

Path Finder

mh.. it's not this way:
I never installed the app in /etc/app. I always use the cluster-master.

I remove the wrong app, restart the peer and then the app is again in /etc/apps!
No deployment-client used.

0 Karma
Highlighted

Re: Automatic linux/nix-TA installation on indexer

Contributor
0 Karma
Highlighted

Re: Automatic linux/nix-TA installation on indexer

Path Finder

oh - nice to see.
But it is the offical splunk audit linux-TA "TA-linux_audit".
We will search if there is any file which is created by the SHC or similar

0 Karma
Highlighted

Re: Automatic linux/nix-TA installation on indexer

Contributor

Can you try moving the app which basically resides in cluster master to some other directory and then push the bundle(which basically will push the app without TA-nix) and see if the app is still in etc/apps on the slaves.

0 Karma
Highlighted

Re: Automatic linux/nix-TA installation on indexer

Path Finder

ok - removed on CM this app - deployed bundle.
then updates to the recent version, and re-deploy.
works now.

0 Karma
Highlighted

Re: Automatic linux/nix-TA installation on indexer

Contributor

Glad to know that it worked.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.