Getting Data In

tarAndChecksum error for deployed app inputs.conf

andrewdidone
Path Finder

Hi,

I'm trying to send configuration through an app to one of my the universal forwarders. The app consists of an inputs.conf and outputs.conf. When I try to do a 'splunk reload deploy-server', it returns with an error "Failed to tarAndChecksum file=C:<deploy-app-folder>" They are currently hosted in the "local" folder of the app, however if i move the config to the "default" folder it seems to work. I'm not receiving anything from the forwarder so I'm guessing some type of file precedence is occurring. Is there any way to fix the "local/inputs.conf" issue?

Thanks,
Andrew

1 Solution

Wallen
Explorer

I assume you are on a Windows installation for your deployment server.

I had the same problem through SPLUNK 6.0.2's GUI of Forwarder Management (Adding an Application), on Server 2012 R2.

It turns out to be an NTFS Permissions issue. When you first create an App from manage apps on the deployment server, the -etc-apps--local folder has different permissions than default, bin, and metadata folders.

To correct the issue, I went into the properties of the -etc-apps--local and turned inheritance on, and replaced inheritance to child objects in that folder.

Then I did the next step and moved the folder to -etc-. Inputs.conf in the local folder no longer caused the tarAndChecksum error.

I hope that helps.

View solution in original post

Wallen
Explorer

I assume you are on a Windows installation for your deployment server.

I had the same problem through SPLUNK 6.0.2's GUI of Forwarder Management (Adding an Application), on Server 2012 R2.

It turns out to be an NTFS Permissions issue. When you first create an App from manage apps on the deployment server, the -etc-apps--local folder has different permissions than default, bin, and metadata folders.

To correct the issue, I went into the properties of the -etc-apps--local and turned inheritance on, and replaced inheritance to child objects in that folder.

Then I did the next step and moved the folder to -etc-. Inputs.conf in the local folder no longer caused the tarAndChecksum error.

I hope that helps.

View solution in original post

paco_jj
Engager

worked, thanks!!

0 Karma

andrewdidone
Path Finder

Thanks for that Wallen. I suspected it was a permissions issue.

Cheers,
Andrew

0 Karma

mpsasecurity
Engager

I had the same exact issue in Windows 2012 R2 when creating a server class for the App for Windows Infrastructure.

The fix that worked for me: disabling inheritance, copy perms. Re-enabling inheritance. Select "replace all child object permission entries with inheritable permission entries from this object" and apply the changes to the folder splunk\etc\deployment-apps

0 Karma

j666gak
Communicator

worked for me, thanks

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.