Deployment Architecture

deploy apps to clients

Chubbybunny
Splunk Employee
Splunk Employee

We have a deployment server which pushes custom apps to Search Head, Indexers, Heavyforwarders. We have Search app which contains props and transforms for Search Time field extraction. Whenever we make changes to the conf files within and when we issue the command splunk reload deploy-server / splunk restart on the deployment monitor, the app fails to get pushed to the search head. The other servers have no issue like this. We see the following errors in splunkd.log from the search head

01-08-2013 17:05:29.427 -0500 WARN DeployedApplication - Unable to remove folder: D:\ProgramFiles\Splunk\etc\apps\ipc_etac_search_props. Splunk will continue trying to install application. There are no more files.
01-08-2013 17:05:29.427 -0500 WARN DeployedApplication - Installing app: ipc_etac_search_props to location: D:\ProgramFiles\Splunk\etc\apps\ipc_etac_search_props
01-08-2013 17:05:29.427 -0500 WARN DeployedApplication - Failed to create file D:\ProgramFiles\Splunk\etc\apps\ipc_etac_search_props\lookups\alliance_alarm_info_lookup.csv while untarring D:\ProgramFiles\Splunk\var\run\ipc_All_Search\ipc_etac_search_props-1357681952.bundle: Access is denied.
01-08-2013 17:05:29.427 -0500 WARN DeployedServerClass - There was a problem installing app: ipc_etac_search_props for server class: ipc_All_Search
01-08-2013 17:05:29.474 -0500 ERROR ConfObjectManagerDB - Cannot initialize: D:\ProgramFiles\Splunk\etc\apps\ipc_etac_search_props\metadata\local.meta: The system cannot find the path specified.

Symptom of the issue is usually the app's metadata folder is missing in the deployed app. Once the splunkd restart has occurred, metadata folder reappears, and app would be functional again. However, the next deployment cycle would break it again, and a splunkd restart would be required.

1 Solution

splunkIT
Splunk Employee
Splunk Employee

The old file was being used by the app, so that it couldn't been replaced.
Once splunkd with the app has stopped, the patch can be applied to the app so that restart will make it work. This is a normal behavior on Windows platform.

View solution in original post

splunkIT
Splunk Employee
Splunk Employee

The old file was being used by the app, so that it couldn't been replaced.
Once splunkd with the app has stopped, the patch can be applied to the app so that restart will make it work. This is a normal behavior on Windows platform.

Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...