All Apps and Add-ons

Why am I getting an error about No spec file on the deployment server when deploying Splunk_TA_nix?

BrandonKeep
Explorer

I downloaded the latest version of the Splunk addon for linux and when deploying, I see this error in the web UI "No spec file for: /opt/splunk/etc/master-apps/Splunk_TA_nix/default/eventgen.conf"

The app was deployed and exists on the indexers. Just curious why I am seeing this on a fresh install.

What can I do to resolve this?
Regards,
Brandon

0 Karma
1 Solution

xpac
SplunkTrust
SplunkTrust

As far as I see this - because the TA ships with a eventgen.conf (which it shouldn't), and to correctly interpret such a config, Splunk would need the eventgen.conf.spec from the eventgen TA. As you don't have that it installed, it complains because it can't verify that .conf file. You can safely ignore this (and better, remove that eventgen.conf from the app at all).

View solution in original post

xpac
SplunkTrust
SplunkTrust

As far as I see this - because the TA ships with a eventgen.conf (which it shouldn't), and to correctly interpret such a config, Splunk would need the eventgen.conf.spec from the eventgen TA. As you don't have that it installed, it complains because it can't verify that .conf file. You can safely ignore this (and better, remove that eventgen.conf from the app at all).

View solution in original post

BrandonKeep
Explorer

Thanks for the clear answer.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.