Deployment Architecture

Why am I getting error "Application does not exist" when applying a shcluster-bundle via Deployer to a search head cluster?

Path Finder

Hi All,

We are trying to create an app for our monitoring purposes, but when I have tried to deploy this through our search head cluster, we are getting below error message.

We have our new app created here in our Deployer.

cd /opt/monitor/splunk/etc/shcluster/apps/Ops_Alerts/local

We have tried to deploy using this command.

 ./splunk apply shcluster-bundle -target -auth admin:splunk

but we are getting this error:

Error while deploying apps to first member: ConfDeploymentException: Error while updating app=Ops_Alerts on target= Non-200/201 status_code=404; {"messages":[{"type":"ERROR","text":"Application does not exist: "}]}



check your file permissions. this was my problem.

chown splunk.splunk -R

0 Karma

Path Finder

I realize this is an old thread, but this same problem hit me. This is a case of a deployment server pushing apps to the master_apps directory on a index cluster master (using targetRepositoryLocation). The problem was that the apps were set in serverclass.conf on the deployment server with:

stateOnClient = enabled 

By changing this to:

stateOnClient = noop

the problem went away.

Path Finder

Check to make sure the file permissions on the new app are in line with the user Splunk is running as. For example, if Splunk is running under the "splunk" user, the app should have owner and group set to "splunk."

0 Karma


I also don't think you can use "local" on a deployed app. That should be default as the search head cluster uses local for any changes made on the search heads themselves.

0 Karma


Apps which have ben pushed by the deplyoer never have a local directory on the search heads. Even if you create a local directory on the deployer and push it to the cluster members, the deplyoer merges all the files under local and default to one file in the default directory on the search head. So you can use a local directory on the app directory if you push them by the deployer as the deployer changes it to default automatically. The local directory wil be created ond the search head cluster member as soon as a user creates a knowledge object which is shared within the app.


I just had this happen to me as well. On a hunch, since I had only created directories for the app and no content yet, I created a README.txt file in the app directory. With a file in the directory I was able to apply the cluster bundle. I suspect that you need to have a t least one file somewhere in the app.

0 Karma


Same story - in my case the app folder was not consistent, in fact i hadn't create a local directory in it. Check your "deployer app" an it's subfolders to be consistent.

0 Karma


It seems that other search heads are not aware of this app and complaining, not sure though . Is the target in the error message is same as the target you have mentioned in shcluster-bundle command ? If they are different , a restart of the search head which throws this error should resolve the issue.

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...