I have an App that I am attempting to push out via the Deployment Server, but on the client I get the following in the splunkd.log. The client is Windows and the Deployment server is xNIX.
Any ideas on why the client thinks the App doesn't exists? Or why it reports a HTTP/1.1 400 Bad Request, error? Other apps work with out issue.
09-13-2011 00:20:15.642 WARN DeployedApplication - There was a problem downloading from uri=splunk:<port>, path=/services/streams/deployment?name=default:outputs:outputs
09-13-2011 00:20:15.642 WARN DeployedApplication - Expected archive: does not exist to install application: outputs
09-13-2011 00:20:15.642 WARN DeployedServerClass - There was a problem installing app: outputs for server class: outputs
09-13-2011 00:20:15.892 INFO DeployedApplication - Checksum mismatch 0 <> 8913487863662561236 for app: outputs. It will be reloaded again from: splunk:<port>/services/streams/deployment?name=default:outputs:outputs
09-13-2011 00:20:15.892 INFO DeployedApplication - Remote repository has resolved to: splunk:<port>/services/streams/deployment?name=default:outputs:outputs
09-13-2011 00:20:15.985 WARN HTTPClient - No File-Name header field found in
HTTP/1.1 400 Bad Request
I'm not 100% sure if this is the a complete answer of not, but this what I did to resolve my issue.
This was simply an issue of the LFC/UFC taking a while (like 40 minutes) to contact and download all of the Apps from the deployment server.
I simply restarted my deployment server a few times and restarted splunkd on the UFC/LFC side.
It looks like when you have a very busy deployment server, these are the types of WARNs you get in your client logs.
I'd be curious to hear if anyone finds any other instances where they see these WARNs.