Deployment Architecture

Unable to apply search head cluster bundle, how to resolve error "Error while deploying apps to first member: Error while fetching apps baseline on target"?

sborys
Explorer

I am trying to push an app through my deployment server onto my 3 Search Heads. I unzipped the app into /opt/splunk/etc/shcluster/apps/

I input in /opt/splunk/bin: sudo ./splunk apply shcluster-bundle -target https://x.x.x.x:8089 -auth admin:password

In return I receive :

Error while deploying apps to first member: Error while fetching apps baseline on target=https://x.x.x.x:8089: Non-200/201 status_code=401; {"messages":[{"type":"WARN","text":"call not properly authenticated"}]}

There are similar posts out there, but I still have not found an answer.

Any ideas?

Sebastian

Gregster66
Engager

Had the same problem and managed to find out what was causing it. 

In my case I messed up when initializing the search heads and gave them the wrong value of the conf_deploy_fetch_url. 

if that value does not match with the url of the deployer it will not accept the bundle you are trying to push out. 

0 Karma

daymauler
Explorer

make sure you that your -target is pointing to the right server e.g. /opt/splunk/bin/splunk apply shcluster-bundle -target https://1.1..200:8089 instead of .g. /opt/splunk/bin/splunk apply shcluster-bundle -target https://1.1..200:8089

0 Karma

grezendedossant
Splunk Employee
Splunk Employee

You must set the key, specify the pass4SymmKey attribute in the [shclustering] stanza of the deployer's server.conf file.
[shclustering]
pass4SymmKey =

yahuja_splunk
Splunk Employee
Splunk Employee

try running this command to make sure cluster members are in sync before applying the bundle.

splunk resync shcluster-replicated-config

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...