Deployment Architecture

Unable to apply search head cluster bundle, how to resolve error "Error while deploying apps to first member: Error while fetching apps baseline on target"?


I am trying to push an app through my deployment server onto my 3 Search Heads. I unzipped the app into /opt/splunk/etc/shcluster/apps/

I input in /opt/splunk/bin: sudo ./splunk apply shcluster-bundle -target https://x.x.x.x:8089 -auth admin:password

In return I receive :

Error while deploying apps to first member: Error while fetching apps baseline on target=https://x.x.x.x:8089: Non-200/201 status_code=401; {"messages":[{"type":"WARN","text":"call not properly authenticated"}]}

There are similar posts out there, but I still have not found an answer.

Any ideas?



Had the same problem and managed to find out what was causing it. 

In my case I messed up when initializing the search heads and gave them the wrong value of the conf_deploy_fetch_url. 

if that value does not match with the url of the deployer it will not accept the bundle you are trying to push out. 

0 Karma


make sure you that your -target is pointing to the right server e.g. /opt/splunk/bin/splunk apply shcluster-bundle -target https://1.1..200:8089 instead of .g. /opt/splunk/bin/splunk apply shcluster-bundle -target https://1.1..200:8089

0 Karma

Splunk Employee
Splunk Employee

You must set the key, specify the pass4SymmKey attribute in the [shclustering] stanza of the deployer's server.conf file.
pass4SymmKey =

Splunk Employee
Splunk Employee

try running this command to make sure cluster members are in sync before applying the bundle.

splunk resync shcluster-replicated-config

0 Karma
Get Updates on the Splunk Community!

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...