Deployment Architecture

When I run $SPLUNK_HOME/bin/splunk apply shcluster-bundle -action stage on my deployer, I get Your session is invalid. Please login.

cdhippen
Path Finder

I put an app onto our deployer server under /opt/splunk/etc/shcluster/apps , ran the following:

sudo su splunk
cd /opt/splunk/etc/shcluster/apps/
[splunk@es-deployer-1 apps]$ /opt/splunk/bin/splunk apply shcluster-bundle -action stage
 Warning: Depending on the configuration changes being pushed, this command might initiate a rolling restart of the cluster members.  Please refer to the documentation for the details. Do you wish to continue? [y/n]: y
Your session is invalid.  Please login.
Splunk username: admin
Password: 
Login failed

I can ping all of the search heads from this deployer server, and people have deployed apps here in the past (although this is my first time on this deployer), so I'm not sure what's going on.

0 Karma
1 Solution

ikelockett
Engager

Check that the user you're using is in $SPLUNKDIR$/etc/passwd. I've had this issue before where your user is on the search head but due to operational oversight, you aren't there on the deployer...

View solution in original post

ikelockett
Engager

Check that the user you're using is in $SPLUNKDIR$/etc/passwd. I've had this issue before where your user is on the search head but due to operational oversight, you aren't there on the deployer...

isoutamo
SplunkTrust
SplunkTrust

Hi

You should use

splunk apply shcluster-bundle -target :

Where target server is one of your SHs.

R. Ismo

0 Karma

cdhippen
Path Finder

I'm not trying to apply the bundle I'm trying to stage it first, wouldn't this skip the staging step and potentially shut down the environment if there's a problem?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Even you do an action stage on the first phase to check if rolling-restart has needed you must specify the —target https://shX.doma.in:8089.

0 Karma

cdhippen
Path Finder

Tried this, same problem.

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...