I put an app onto our deployer server under /opt/splunk/etc/shcluster/apps , ran the following:
sudo su splunk cd /opt/splunk/etc/shcluster/apps/ [splunk@es-deployer-1 apps]$ /opt/splunk/bin/splunk apply shcluster-bundle -action stage Warning: Depending on the configuration changes being pushed, this command might initiate a rolling restart of the cluster members. Please refer to the documentation for the details. Do you wish to continue? [y/n]: y Your session is invalid. Please login. Splunk username: admin Password: Login failed
I can ping all of the search heads from this deployer server, and people have deployed apps here in the past (although this is my first time on this deployer), so I'm not sure what's going on.
You should use
splunk apply shcluster-bundle -target :
Where target server is one of your SHs.
I'm not trying to apply the bundle I'm trying to stage it first, wouldn't this skip the staging step and potentially shut down the environment if there's a problem?
Tried this, same problem.
Check that the user you're using is in $SPLUNKDIR$/etc/passwd. I've had this issue before where your user is on the search head but due to operational oversight, you aren't there on the deployer...