Deployment Architecture

Deployment client error for cluster master apps


I have a Cluster Master which is a deployment client as well with the following deploymentclient.conf file.


disabled = false

serverRepositoryLocationPolicy = rejectAlways

repositoryLocation = $SPLUNK_HOME/etc/master-apps


targetUri = index1:8089

Deployment client populates the $SPLUNK_HOME/etc/master-apps correctly, however there are lots of errors in splunkd.log as follows :


02-11-2014 14:41:22.537 +1100 INFO DeployedApplication - Installing app=testapp to='/opt/splunk/etc/master-apps/testapp'

02-11-2014 14:41:22.612 +1100 ERROR DeployedApplication - Failed to install app=/opt/splunk/etc/master-apps/testapp; reason=Application does not exist: testapp

02-11-2014 14:41:22.612 +1100 ERROR DeployedServerclass - name=Cluster_Master Failed to install app=testapp

All splunk instances are VERSION 6.0.1 Build 189883 on REDHAT if this makes a difference.

This also shows up in the Forwarder Management as Deployment Errors !!

Any help would be appreciated

Tags (1)

Path Finder

as a cronjob or something....

for i in `ls /opt/splunk/etc/master-apps/ | grep -v _cluster`; do echo $i; echo ln -sf /opt/splunk/etc/master-apps/$i /opt/splunk/etc/apps/; done

New Member

I had the same problem and it looks like a bug with the way Splunk validates the application installation, as it will look for it on the /opt/splunk/etc/apps directory even though this was overwritten by the deployment.conf file.

My way to make the error go away was to create symbolic links in the /opt/splunk/etc/apps to the applications deployed in the /opt/splunk/etc/master-apps directory. This had to be done for each APP deployed via the deployment server.

In this example, I deployed the TA add-on for SoS using the deployment server to push the APP to the cluster master and from there to the peers.

[LAB]/opt/splunk/etc/apps # ln -s /opt/splunk/etc/master-apps/TA-sos TA-sos
[LAB]/opt/splunk/etc/apps # ls -l TA-sos

lrwxrwxrwx 1 root root 34 Jul 8 13:51 TA-sos -> /opt/splunk/etc/master-apps/TA-sos

[LAB]/opt/splunk/etc/apps # ls -ld /opt/splunk/etc/master-apps/TA-sos

drwx------ 7 root root 4096 Jul 8 13:51 /opt/splunk/etc/master-apps/TA-sos

[LAB]/opt/splunk/etc/apps #

This solved the issue (errors are no longer in splunkd.log), but I'm not a big fan of symbolic links and it's a manual step that you need to add to you MOP when deploying these apps; that is making me wonder if it's worth it to manage the cluster apps via the deployment server.

I will try to log a support case for this.

0 Karma


I am also seeing the same problem with Splunk 6.0.2 on Windows 😞

0 Karma


This is the serverclass.conf file ..
whitelist.0 =

restartSplunkWeb = 0
restartSplunkd = 0
stateOnClient = enabled

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...