Deployment Architecture

Unable to deploy an custom app through a deployer

New Member

Hello Team , i have built search head cluster and i 'm trying to deploy and app thru deployer but getting the error "Error while deploying apps to first member, aborting apps deployment to all members: Error while updating app=new_app on target=https://...:8089: Non-200/201 status_code=500; {"messages":[{"type":"ERROR","text":"\n In handler 'localapps': Error installing application: Failed to copy file from \"/opt/splunk/var/run/splunk/bundle_tmp/e7e684930fe6ff3c/new_app/sample_app\" to \"/opt/splunk/etc/apps/new_app/sample_app\"."}]}"

Here are my app details of my app, its a simple alert i saved in my app which i named new_app

root@deployer:/opt/splunk/etc/shcluster/apps# ll
total 20
drwxrwxrwt 3 splunk splunk 4096 Nov 20 04:39 ./
drwxr-xr-x 4 splunk splunk 4096 Nov 10 22:22 ../
-r--r--r-- 1 splunk splunk 121 Oct 19 02:20 README
drwxr-xr-x 2 splunk splunk 4096 Nov 20 04:27 new_app/
-rw-r--r-- 1 splunk splunk 46 Nov 14 19:25 temp
root@deployer:/opt/splunk/etc/shcluster/apps# cd new_app
root@deployer:/opt/splunk/etc/shcluster/apps/new_app# ll
total 12
drwxr-xr-x 2 splunk splunk 4096 Nov 20 04:27 ./
drwxrwxrwt 3 splunk splunk 4096 Nov 20 04:39 ../
-rwxrwxrwx 1 splunk splunk 492 Nov 20 04:27 sample_app*
root@deployer:/opt/splunk/etc/shcluster/apps/new_app# cat sample_app
[sample alert1] = 1 = ******** = 1
alert.suppress = 0
alert.track = 0
counttype = number of events
cron_schedule = 0 6 * * 1
dispatch.earliest_time = -1w
dispatch.latest_time = now
display.general.type = statistics = statistics
enableSched = 1
quantity = 0
relation = greater than
request.ui_dispatch_app = search
request.ui_dispatch_view = search
search = index=
| stats count by source,sourcetype

0 Karma

Ultra Champion

you need to have your alert configured in the file named alert_actions.conf
You should locate this file in /opt/splunk/etc/shcluster/apps/new_app/default/alert_actions.conf

If my comment helps, please give it a thumbs up!
0 Karma


you need to have typical app structure

"shcluster" directory

that's what this error was for me

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...