All Apps and Add-ons

How to troubleshoot error "File length is greater than 260" trying to deploy the latest Splunk App for Microsoft Exchange?

capilarity
Path Finder

I'm trying to deploy the latest Splunk App for Microsoft Exchange via the masternode to 3 indexers, but it's failing and usefully does not report what the error is:

In handler 'clustermastercontrol': The Master could not push the latest configuration bundle because it contains an invalid configuration. Fix any errors and push the bundle again. Alternatively, you can skip the validation process like this: "splunk apply cluster-bundle --skip-validation". Use this option carefully, as it can cause the master to push an invalid configuration to the peers. The following errors were encountered:

Looking thought the _internal index I've found an error that suggests the path is too long:

WARN  CMBundleMgr - File length is greater than 260, File creation may fail for D:/Splunk/var/run/splunk/cluster/remote-bundle/7e52479e51b29c16f30c46882e9c02ca-1427286758/apps/splunk_app_microsoft_exchange/django/splunk_app_microsoft_exchange/static/common/grayskull/common/controls/multirangeverticalslider/MultiRangeVerticalSliderRangeDefinitionModel.js

(the file path is 275 characters long)
followed by a "System cannot find the path specified message"

CMBundleMgr - Failed to create file D:/Splunk/var/run/splunk/cluster/remote-bundle/7e52479e51b29c16f30c46882e9c02ca-1427286758/apps/splunk_app_microsoft_exchange/django/splunk_app_microsoft_exchange/static/common/grayskull/common/controls/multirangeverticalslider/MultiRangeVerticalSliderRangeDefinitionModel.js while untarring D:/Splunk/var/run/splunk/cluster/remote-bundle/7e52479e51b29c16f30c46882e9c02ca-1427286758.bundle: The system cannot find the path specified.

This is a standard install, no changes have been made.

Has anyone else had this issue? Any work-arounds other than renaming ALL the files?
This a Windows Splunk install monitoring a windows environment.

0 Karma
1 Solution

capilarity
Path Finder

Found the answer is that you don't deploy the app to the indexers, its only needed on the search head.

View solution in original post

0 Karma

capilarity
Path Finder

Found the answer is that you don't deploy the app to the indexers, its only needed on the search head.

0 Karma

malmoore
Splunk Employee
Splunk Employee

What version of Exchange App are you using?
What version of Splunk Enterprise?

0 Karma

capilarity
Path Finder

Thanks for your response but I have found out the cause... I was trying to deploy the app to the indexers as I assumed there would be some index time extractions, but this is not the case.
The indexers only need to have the indexes.conf file - nothing else so don't need to deploy the app
We only have a single search head so installed manually without a problem - don't know what would happen if you had multiple search head though?

0 Karma

malmoore
Splunk Employee
Splunk Employee

Unfortunately a file rename is likely the only answer here. You could also try to set up a symbolic link, but it's not guaranteed that bundle replication would work under such a scheme.

I've filed a ticket regarding extreme file lengths on Windows for engineers to triage. In order to officially get resources on it, you should file a support case.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...