tarAndChecksum error for deployed app inputs.conf

[andrewdidone]

Hi,

I'm trying to send configuration through an app to one of my the universal forwarders. The app consists of an inputs.conf and outputs.conf. When I try to do a 'splunk reload deploy-server', it returns with an error "Failed to tarAndChecksum file=C:<deploy-app-folder>" They are currently hosted in the "local" folder of the app, however if i move the config to the "default" folder it seems to work. I'm not receiving anything from the forwarder so I'm guessing some type of file precedence is occurring. Is there any way to fix the "local/inputs.conf" issue?

Thanks,
Andrew

[Wallen · Accepted solution]

I assume you are on a Windows installation for your deployment server.

I had the same problem through SPLUNK 6.0.2's GUI of Forwarder Management (Adding an Application), on Server 2012 R2.

It turns out to be an NTFS Permissions issue. When you first create an App from manage apps on the deployment server, the -etc-apps--local folder has different permissions than default, bin, and metadata folders.

To correct the issue, I went into the properties of the -etc-apps--local and turned inheritance on, and replaced inheritance to child objects in that folder.

Then I did the next step and moved the folder to -etc-. Inputs.conf in the local folder no longer caused the tarAndChecksum error.

I hope that helps.

[paco_jj]

worked, thanks!!

[andrewdidone]

Thanks for that Wallen. I suspected it was a permissions issue.

Cheers,
Andrew

[mpsasecurity]

I had the same exact issue in Windows 2012 R2 when creating a server class for the App for Windows Infrastructure.

The fix that worked for me: disabling inheritance, copy perms. Re-enabling inheritance. Select "replace all child object permission entries with inheritable permission entries from this object" and apply the changes to the folder splunk\etc\deployment-apps

[j666gak]

worked for me, thanks