Why can't I push SH bundles?

[ddrillic]

When running the following - /opt/splunk/bin/splunk apply shcluster-bundle -target https://<SH Host>.<domain>.com:8089, I get the following -

Warning: Depending on the configuration changes being pushed, this command might initiate a rolling restart of the cluster members.  Please refer to the documentation for the details. Do you wish to continue? [y/n]: y
Your session is invalid.  Please login.
Splunk username: admin
Password: 
Search Head Cluster Deployer: The configuration bundle contains the following default apps: SplunkForwarder, SplunkLightForwarder, framework, gettingstarted, introspection_generator_addon, launcher, learned, legacy, sample_app, search, user-prefs.

It is strongly recommended that you not use the deployer to push default apps to the search head cluster members. Read the topic "Use the deployer to distribute apps and configuration updates" in the Distributed Search manual on docs.splunk.com for details.

If you are sure you want to do this, push the configuration bundle again using the "-push-default-apps true" option.

The cluster has been upgraded recently to 7.x.

What can this be?

[adonio · Accepted solution]

Hello @ddrillic,

answered on your other question regarding user-pref.conf first
the apps mentioned above, are native to splunk and exists in any new splunk install.
these apps can not be pushed in a bundle from deployer to search head cluster members.
with that being said, you can take you user-prefs.conf file and place it in a new app and push to members.
read more in this article:
http://docs.splunk.com/Documentation/Splunk/7.0.1/DistSearch/Migratefromstandalonesearchheads#Do_not...

in general steps, i will verify that there are no items in the local directory in the native splunk apps (the ones you mentioned). will pay specific attention to search and launcher, as users tend to save items in them.
then ill create a new app and name it "migration" or something of that sort. will place all files mentioned above in this app and push this app to the cluster members. make sure to have all configuration on the migration app and the app itself global

hope it helps

[ddrillic]

For the record, a sub-issue at What is the proper location of user-prefs.conf?

[ddrillic]

I wonder if I can run the following -

/opt/splunk/bin/splunk apply shcluster-bundle -target https://<SH Host>.<domain>.com:8089 push-default-apps false

And the default Splunk apps shouldn't be on the deployer, right? so I wonder how they reached here...

[somesoni2]

You're correct about those default apps shouldn't be there in the deployer (shcluster/apps dir). Were they there before your upgrade? May be check the timestamp to when they were copied.

[ddrillic]

What I see is that in production which is 6.x these default apps are there and the deployer doesn't complain whereas in stage after the upgrade to 7.x the deployer complain about them - somebody apparently changed the software ; -)