I'm trying to deploy the latest Splunk App for Microsoft Exchange via the masternode to 3 indexers, but it's failing and usefully does not report what the error is:
In handler 'clustermastercontrol': The Master could not push the latest configuration bundle because it contains an invalid configuration. Fix any errors and push the bundle again. Alternatively, you can skip the validation process like this: "splunk apply cluster-bundle --skip-validation". Use this option carefully, as it can cause the master to push an invalid configuration to the peers. The following errors were encountered:
Looking thought the _internal index I've found an error that suggests the path is too long:
WARN CMBundleMgr - File length is greater than 260, File creation may fail for D:/Splunk/var/run/splunk/cluster/remote-bundle/7e52479e51b29c16f30c46882e9c02ca-1427286758/apps/splunk_app_microsoft_exchange/django/splunk_app_microsoft_exchange/static/common/grayskull/common/controls/multirangeverticalslider/MultiRangeVerticalSliderRangeDefinitionModel.js
(the file path is 275 characters long)
followed by a "System cannot find the path specified message"
CMBundleMgr - Failed to create file D:/Splunk/var/run/splunk/cluster/remote-bundle/7e52479e51b29c16f30c46882e9c02ca-1427286758/apps/splunk_app_microsoft_exchange/django/splunk_app_microsoft_exchange/static/common/grayskull/common/controls/multirangeverticalslider/MultiRangeVerticalSliderRangeDefinitionModel.js while untarring D:/Splunk/var/run/splunk/cluster/remote-bundle/7e52479e51b29c16f30c46882e9c02ca-1427286758.bundle: The system cannot find the path specified.
This is a standard install, no changes have been made.
Has anyone else had this issue? Any work-arounds other than renaming ALL the files?
This a Windows Splunk install monitoring a windows environment.
Unfortunately a file rename is likely the only answer here. You could also try to set up a symbolic link, but it's not guaranteed that bundle replication would work under such a scheme.
I've filed a ticket regarding extreme file lengths on Windows for engineers to triage. In order to officially get resources on it, you should file a support case.
What version of Exchange App are you using?
What version of Splunk Enterprise?
Thanks for your response but I have found out the cause... I was trying to deploy the app to the indexers as I assumed there would be some index time extractions, but this is not the case.
The indexers only need to have the indexes.conf file - nothing else so don't need to deploy the app
We only have a single search head so installed manually without a problem - don't know what would happen if you had multiple search head though?
Found the answer is that you don't deploy the app to the indexers, its only needed on the search head.