Deployment Architecture

ERROR reading deployment app that isn't deployed to clients

DEAD_BEEF
Builder

My search head is the deployment server. Going through the splunkd log for ERROR and finding the following errors for multiple apps

ERROR Application - Application=<my_app> cannot be loaded, as path=/opt/splunk/etc/deployment-apps/<my_app> does not exist.
ERROR Serverclass - Failed to load app. Application=<my_app> cannot be loaded, as path=/opt/splunk/etc/deployment-apps/<my_app> does not exist.

Here are the oddities to this:

  • the <my_app> folder DOES exist in /opt/splunk/etc/deployment-apps/
  • the <my_app> is NOT deployed to any clients nor part of any server class
  • the folder is owned by splunk:splunk
  • the folder has the same permissions as the other app folders

If the folder exists, owned by the correct user with the right permissions, and is NOT deployed, what is causing these errors to generate? Is there some file that needs to be refreshed so that the deployment server stops trying to access/send this to the clients?

0 Karma
1 Solution

DEAD_BEEF
Builder

The app was listed in one of the [serverClass:...] entries despite not being deployed to any client nor listed under any server class (in the gui). I commented out and restarted services. I have not seen the error since then so I'll close this out as the solution. Check your serverclass.conf!

View solution in original post

0 Karma

DEAD_BEEF
Builder

The app was listed in one of the [serverClass:...] entries despite not being deployed to any client nor listed under any server class (in the gui). I commented out and restarted services. I have not seen the error since then so I'll close this out as the solution. Check your serverclass.conf!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try to run btool on serverclass.conf to see if any instance of serverclass.conf file is doing anything with <my_app>.

$SPLUNK_HOME/bin/splunk btool serverclass list --debug | grep my_app
0 Karma

DEAD_BEEF
Builder

<my_app> did show up in one listing. It looks like <my_app> was listed in one of the [serverClass:...] despite not being deployed to any client nor listed under any server class (in the gui). I commented <my_app> out and restarted services.

No new errors of this kind since the changes. I will monitor for a few days and mark as solved if this proves to be the solution.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...