Deployment Architecture

deploy apps to clients

Chubbybunny
Splunk Employee
Splunk Employee

We have a deployment server which pushes custom apps to Search Head, Indexers, Heavyforwarders. We have Search app which contains props and transforms for Search Time field extraction. Whenever we make changes to the conf files within and when we issue the command splunk reload deploy-server / splunk restart on the deployment monitor, the app fails to get pushed to the search head. The other servers have no issue like this. We see the following errors in splunkd.log from the search head

01-08-2013 17:05:29.427 -0500 WARN DeployedApplication - Unable to remove folder: D:\ProgramFiles\Splunk\etc\apps\ipc_etac_search_props. Splunk will continue trying to install application. There are no more files.
01-08-2013 17:05:29.427 -0500 WARN DeployedApplication - Installing app: ipc_etac_search_props to location: D:\ProgramFiles\Splunk\etc\apps\ipc_etac_search_props
01-08-2013 17:05:29.427 -0500 WARN DeployedApplication - Failed to create file D:\ProgramFiles\Splunk\etc\apps\ipc_etac_search_props\lookups\alliance_alarm_info_lookup.csv while untarring D:\ProgramFiles\Splunk\var\run\ipc_All_Search\ipc_etac_search_props-1357681952.bundle: Access is denied.
01-08-2013 17:05:29.427 -0500 WARN DeployedServerClass - There was a problem installing app: ipc_etac_search_props for server class: ipc_All_Search
01-08-2013 17:05:29.474 -0500 ERROR ConfObjectManagerDB - Cannot initialize: D:\ProgramFiles\Splunk\etc\apps\ipc_etac_search_props\metadata\local.meta: The system cannot find the path specified.

Symptom of the issue is usually the app's metadata folder is missing in the deployed app. Once the splunkd restart has occurred, metadata folder reappears, and app would be functional again. However, the next deployment cycle would break it again, and a splunkd restart would be required.

1 Solution

splunkIT
Splunk Employee
Splunk Employee

The old file was being used by the app, so that it couldn't been replaced.
Once splunkd with the app has stopped, the patch can be applied to the app so that restart will make it work. This is a normal behavior on Windows platform.

View solution in original post

splunkIT
Splunk Employee
Splunk Employee

The old file was being used by the app, so that it couldn't been replaced.
Once splunkd with the app has stopped, the patch can be applied to the app so that restart will make it work. This is a normal behavior on Windows platform.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...