Deployment Architecture

Search Head Cluster bundle push failed with error Network-layer error: Read Timeout

sat94541
Communicator

Issue: We are on Splunk version 6.6.3 and when we push the Search Head Cluster Bundle from the Deployer to Search Head Cluster Member it fails with error

Deployer's "splunk apply shcluster-bundle" output
{noformat}
[splunk662T]# ./bin/splunk apply shcluster-bundle -target "https://10.140.54.186:55821"
Warning: Depending on the configuration changes being pushed, this command might initiate a rolling restart of the cluster members.

Please refer to the documentation for the details. Do you wish to continue? [y/n]: y

Error while deploying apps to first member: Error while updating app=unix on target=https://10.140.54.187:55821: Network-layer error: Read Timeout

rbal_splunk
Splunk Employee
Splunk Employee

The workaround is to disable conditional expansion by setting following on the deployer and the Search Head.
[search]
enable_conditional_expansion=false

0 Karma

traxxasbreaker
Communicator

Which file would those be set in? The [search] stanza sounds like limits.conf but I don't see this setting in the spec.

When we hit this problem restarting the deployer seems to help but a solution that doesn't require waiting for it to fail and restarting would be much better.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...