Deployment Architecture

Deployment App not downloading or installing

gekoner
Communicator

I have an App that I am attempting to push out via the Deployment Server, but on the client I get the following in the splunkd.log. The client is Windows and the Deployment server is xNIX.
Any ideas on why the client thinks the App doesn't exists? Or why it reports a HTTP/1.1 400 Bad Request, error? Other apps work with out issue.

09-13-2011 00:20:15.642 WARN  DeployedApplication - There was a problem downloading from uri=splunk:<port>, path=/services/streams/deployment?name=default:outputs:outputs
09-13-2011 00:20:15.642 WARN  DeployedApplication - Expected archive:  does not exist to install application: outputs
09-13-2011 00:20:15.642 WARN  DeployedServerClass - There was a problem installing app: outputs for server class: outputs
09-13-2011 00:20:15.892 INFO  DeployedApplication - Checksum mismatch 0 <> 8913487863662561236 for app: outputs. It will be reloaded again from: splunk:<port>/services/streams/deployment?name=default:outputs:outputs
09-13-2011 00:20:15.892 INFO  DeployedApplication - Remote repository has resolved to: splunk:<port>/services/streams/deployment?name=default:outputs:outputs
09-13-2011 00:20:15.985 WARN  HTTPClient - No File-Name header field found in
HTTP/1.1 400 Bad Request
0 Karma
1 Solution

gekoner
Communicator

I'm not 100% sure if this is the a complete answer of not, but this what I did to resolve my issue.
This was simply an issue of the LFC/UFC taking a while (like 40 minutes) to contact and download all of the Apps from the deployment server.
I simply restarted my deployment server a few times and restarted splunkd on the UFC/LFC side.
It looks like when you have a very busy deployment server, these are the types of WARNs you get in your client logs.
I'd be curious to hear if anyone finds any other instances where they see these WARNs.

View solution in original post

gekoner
Communicator

I'm not 100% sure if this is the a complete answer of not, but this what I did to resolve my issue.
This was simply an issue of the LFC/UFC taking a while (like 40 minutes) to contact and download all of the Apps from the deployment server.
I simply restarted my deployment server a few times and restarted splunkd on the UFC/LFC side.
It looks like when you have a very busy deployment server, these are the types of WARNs you get in your client logs.
I'd be curious to hear if anyone finds any other instances where they see these WARNs.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...