Deployment Architecture

Why am I getting error "Application does not exist" when applying a shcluster-bundle via Deployer to a search head cluster?

splunker9999
Path Finder

Hi All,

We are trying to create an app for our monitoring purposes, but when I have tried to deploy this through our search head cluster, we are getting below error message.

We have our new app created here in our Deployer.

cd /opt/monitor/splunk/etc/shcluster/apps/Ops_Alerts/local

We have tried to deploy using this command.

 ./splunk apply shcluster-bundle -target https://server1.com:8089 -auth admin:splunk

but we are getting this error:

Error while deploying apps to first member: ConfDeploymentException: Error while updating app=Ops_Alerts on target=https://xx.xxx.x.xxx:8089: Non-200/201 status_code=404; {"messages":[{"type":"ERROR","text":"Application does not exist: "}]}

Thanks

mmoore723
Engager

check your file permissions. this was my problem.

chown splunk.splunk -R

0 Karma

andygerber
Path Finder

I realize this is an old thread, but this same problem hit me. This is a case of a deployment server pushing apps to the master_apps directory on a index cluster master (using targetRepositoryLocation). The problem was that the apps were set in serverclass.conf on the deployment server with:

stateOnClient = enabled 

By changing this to:

stateOnClient = noop

the problem went away.

anshu
Path Finder

Check to make sure the file permissions on the new app are in line with the user Splunk is running as. For example, if Splunk is running under the "splunk" user, the app should have owner and group set to "splunk."

0 Karma

jeremiahc4
Builder

I also don't think you can use "local" on a deployed app. That should be default as the search head cluster uses local for any changes made on the search heads themselves.

0 Karma

claudio_manig
Communicator

Apps which have ben pushed by the deplyoer never have a local directory on the search heads. Even if you create a local directory on the deployer and push it to the cluster members, the deplyoer merges all the files under local and default to one file in the default directory on the search head. So you can use a local directory on the app directory if you push them by the deployer as the deployer changes it to default automatically. The local directory wil be created ond the search head cluster member as soon as a user creates a knowledge object which is shared within the app.

botkindl
Explorer

I just had this happen to me as well. On a hunch, since I had only created directories for the app and no content yet, I created a README.txt file in the app directory. With a file in the directory I was able to apply the cluster bundle. I suspect that you need to have a t least one file somewhere in the app.

0 Karma

claudio_manig
Communicator

Same story - in my case the app folder was not consistent, in fact i hadn't create a local directory in it. Check your "deployer app" an it's subfolders to be consistent.

0 Karma

renjith_nair
Legend

It seems that other search heads are not aware of this app and complaining, not sure though . Is the target in the error message is same as the target you have mentioned in shcluster-bundle command ? If they are different , a restart of the search head which throws this error should resolve the issue.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...