Archive

Search head Clustering bundle Network-layer error: Read Timeout while applying bundle from deployer

Explorer

We have setup a Searchhead cluster for Enterprise Security (3 SHs) .. and receive the below error most of the times we push the bundle from deployer after making changes to the App under /opt/splunk/etc/shcluster/apps/xxxx/

Warning: Depending on the configuration changes being pushed, this command might initiate a rolling restart of the cluster members. Please refer to the documentation for the details. Do you wish to continue? [y/n]: y
Error while deploying apps to first member: Error while updating app=SA-EndpointProtection on t

arget=https://xxxxxxx:8089: Network-layer error: Read Timeout

I have checked the connection between the deployer and SHs over 8089 which is good ... also provided the correct mgmt_uri of the captain ... I see that the changes are getting pushed to the SHs but the deployer does not provide the "bundle has been pushed successfully" message and waits on and then provide the ERROR message

The push worked at times .. i can say 2 out of 10 times and mostly give this error

0 Karma

Splunk Employee
Splunk Employee

Hi

it looks like the apps you are pushing take a little while to deploy
In order to wait for more time, try using
splunk apply sgcluster-bundle -target xxxxx:8089 -timeout 600
with the appropriate timeout value for your env

0 Karma

Explorer

looks like timeout is not a valid paremeter for the shcluster bundle command

0 Karma

New Member

Thank you for the reply.. i have already tried to increase the timeout from default to few mins(2 minutes)... but will try with the command including timeout ... hope this is not related to any other issue than time out

0 Karma