Deployment Architecture

Unable to apply search head cluster bundle, how to resolve error "Error while deploying apps to first member: Error while fetching apps baseline on target"?

sborys
Explorer

I am trying to push an app through my deployment server onto my 3 Search Heads. I unzipped the app into /opt/splunk/etc/shcluster/apps/

I input in /opt/splunk/bin: sudo ./splunk apply shcluster-bundle -target https://x.x.x.x:8089 -auth admin:password

In return I receive :

Error while deploying apps to first member: Error while fetching apps baseline on target=https://x.x.x.x:8089: Non-200/201 status_code=401; {"messages":[{"type":"WARN","text":"call not properly authenticated"}]}

There are similar posts out there, but I still have not found an answer.

Any ideas?

Sebastian

Gregster66
Engager

Had the same problem and managed to find out what was causing it. 

In my case I messed up when initializing the search heads and gave them the wrong value of the conf_deploy_fetch_url. 

if that value does not match with the url of the deployer it will not accept the bundle you are trying to push out. 

0 Karma

daymauler
Explorer

make sure you that your -target is pointing to the right server e.g. /opt/splunk/bin/splunk apply shcluster-bundle -target https://1.1..200:8089 instead of .g. /opt/splunk/bin/splunk apply shcluster-bundle -target https://1.1..200:8089

0 Karma

grezendedossant
Splunk Employee
Splunk Employee

You must set the key, specify the pass4SymmKey attribute in the [shclustering] stanza of the deployer's server.conf file.
[shclustering]
pass4SymmKey =

yahuja_splunk
Splunk Employee
Splunk Employee

try running this command to make sure cluster members are in sync before applying the bundle.

splunk resync shcluster-replicated-config

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...