Deployment Architecture

Deployment App not downloading or installing

gekoner
Communicator

I have an App that I am attempting to push out via the Deployment Server, but on the client I get the following in the splunkd.log. The client is Windows and the Deployment server is xNIX.
Any ideas on why the client thinks the App doesn't exists? Or why it reports a HTTP/1.1 400 Bad Request, error? Other apps work with out issue.

09-13-2011 00:20:15.642 WARN  DeployedApplication - There was a problem downloading from uri=splunk:<port>, path=/services/streams/deployment?name=default:outputs:outputs
09-13-2011 00:20:15.642 WARN  DeployedApplication - Expected archive:  does not exist to install application: outputs
09-13-2011 00:20:15.642 WARN  DeployedServerClass - There was a problem installing app: outputs for server class: outputs
09-13-2011 00:20:15.892 INFO  DeployedApplication - Checksum mismatch 0 <> 8913487863662561236 for app: outputs. It will be reloaded again from: splunk:<port>/services/streams/deployment?name=default:outputs:outputs
09-13-2011 00:20:15.892 INFO  DeployedApplication - Remote repository has resolved to: splunk:<port>/services/streams/deployment?name=default:outputs:outputs
09-13-2011 00:20:15.985 WARN  HTTPClient - No File-Name header field found in
HTTP/1.1 400 Bad Request
0 Karma
1 Solution

gekoner
Communicator

I'm not 100% sure if this is the a complete answer of not, but this what I did to resolve my issue.
This was simply an issue of the LFC/UFC taking a while (like 40 minutes) to contact and download all of the Apps from the deployment server.
I simply restarted my deployment server a few times and restarted splunkd on the UFC/LFC side.
It looks like when you have a very busy deployment server, these are the types of WARNs you get in your client logs.
I'd be curious to hear if anyone finds any other instances where they see these WARNs.

View solution in original post

gekoner
Communicator

I'm not 100% sure if this is the a complete answer of not, but this what I did to resolve my issue.
This was simply an issue of the LFC/UFC taking a while (like 40 minutes) to contact and download all of the Apps from the deployment server.
I simply restarted my deployment server a few times and restarted splunkd on the UFC/LFC side.
It looks like when you have a very busy deployment server, these are the types of WARNs you get in your client logs.
I'd be curious to hear if anyone finds any other instances where they see these WARNs.

Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...